If your child does maths homework on a laptop, there's a fair chance the program is Mathspace. On 3 September 2026 the company confirmed that unauthorised parties had got into one of its internal systems and downloaded records. It says 1,079,819 people are affected — students, parents and guardians, and school staff — and that only people in Australia and New Zealand are involved.
That's a lot of families. It's also a plain reminder that the apps holding our kids' details aren't only the social ones. A maths program isn't social media and it isn't a game. It still knows your child's name, their email address and when they last logged in.
Here's what was taken, what wasn't, and what's worth doing tonight. No panic required. A few checks, one conversation.
Mathspace says attackers exploited a security vulnerability in its self-hosted installation of Metabase, a piece of software the company uses for internal reporting. Its investigation found unauthorised access dating back to 10 August, and information was downloaded from its Australian reporting database on 27 August. The breach was confirmed on 3 September, and the company published its notice on 5 September.
There is a timing detail worth knowing. According to iTnews, Metabase had issued a security advisory on 7 August telling customers to upgrade their self-hosted installations immediately. Mathspace's founder and chief technology officer, Alvin Savoy, told iTnews the company updated its instance on 29 August, after a later Metabase notice came to its attention. iTnews reports the vulnerability carries the maximum severity rating of 10.0.
Who did it is not known. Mathspace told the ABC it did not yet know who was responsible, and that it had found "no evidence so far" that the stolen information had been published, shared or sold. The company says it has reported the incident to the Office of the Australian Information Commissioner and the Australian Cyber Security Centre, and to their New Zealand counterparts, and that affected people are being contacted.
Taken, in Mathspace's own list: user ID, username, first name, last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date and date joined. The ABC notes that not every person had every one of those fields taken.
Not taken: passwords (including the scrambled versions companies store), single sign-on tokens and other login credentials, and — for the kids — no academic records, learning activities, results or assessment records.
The "not taken" list is the good news: nobody can log in as your child with what was stolen. The "taken" list is why this still matters. A name, a school email address and the date someone last logged in is a scammer's starter kit. "Hi Jack, we noticed you last logged in to Mathspace on Tuesday — click here to secure your account" is a message a twelve-year-old would believe.
The Australian Cyber Security Centre's advice after any breach is blunt about this: scammers may pose as the organisation involved, by email, text or phone, and any message should be confirmed with an official source such as the company's own website. Its example is exactly the one to expect here — an email asking you to reset a password because it was compromised.
Two things make a school-platform breach different from, say, a retailer's. First, many children's Mathspace logins are their school email addresses, so the scam messages may land in an inbox you never see. Second, parents and guardians are on the affected list too. This is your data as much as your child's.
If something does go wrong — money lost, an account taken over — report it through the ACSC's ReportCyber service, and tell the school.
A data breach is one more reason the online-safety conversation belongs at the kitchen table, not just in the settings menu. If you want a way in, our guide on how to talk to your kid about online safety is a good place to start: auntybea.app/guides/how-to-talk-to-your-kid-about-online-safety
Read next: our guide →
Aunty Bea helps Australian families with what comes next, quietly. You'll never scroll your child's messages in Aunty Bea. You get a plain-English summary of what looked risky, and how to talk about it.
Get started free →