Mathspace data breach affects over 1 million users

Mathspace said it confirmed on September 3 that attackers had accessed an internal reporting system and downloaded user information. The breach involved 1,079,819 people.

The exposed data included names, email addresses, usernames, user IDs, countries, time zones, account types and information about when users joined or last accessed the platform. Not every affected account contained all these details.

However, Mathspace said no passwords, authentication tokens, SSO credentials, API credentials, academic records, assessment results or learning activities were exposed.

"We have no evidence so far that the data has been published, distributed, sold or otherwise misused," the company said, adding that the attackers remain unidentified.

According to Mathspace, hackers exploited vulnerability in its self-hosted Metabase reporting software. Unauthorized access dated back to August 10, while information was downloaded from its Australian database on August 27.

Metabase had issued a critical security advisory and patched versions on August 6, but Mathspace acknowledged that its vulnerability-notification process failed to escalate the warning for action.

"Names, email addresses and account details can make impersonation attempts more convincing," Mathspace warned, urging users to be cautious of unexpected messages, password-reset emails and requests for verification codes.

The compromised reporting service has since been taken offline, while affected schools, education departments and cybersecurity authorities have been notified.

"We're truly sorry this happened and are taking steps to prevent similar breaches in the future," Mathspace said.

Earlier, Qazinform News Agency reported that AI agents had attempted to deceive real people and interfere with open-source software during a controlled cybersecurity evaluation, marking the first time researchers observed such behavior without explicit instructions, according to the UK's AI Safety Institute (AISI).