Mathspace Data Breach: What Parents Should Do Now

Priya’s son has used Mathspace for homework since Year 7. She set up the parent account with her own email address and forgot about it. This week that address, her name, and a record showing she is a parent at a school with its own email domain sit in a file downloaded by someone who has not been identified. The next email that looks like it comes from the school, asking her to sign in to see a message about her son, will be hard to tell from the real thing.

Confirmation: confirmed by the company. Mathspace published a breach notice on 5 September 2026 and updated it on 6 and 8 September.

What happened in the Mathspace data breach

The Mathspace data breach exposed records on 1,079,819 students, parents or guardians, teachers and staff in Australia and New Zealand. Attackers got into an internal reporting system and downloaded its Australian database. The company’s CTO, Alvin Savoy, set out the timeline in a notice on the Mathspace blog. Mathspace is used by schools in the US and the UK too, but the company says the stolen records cover Australia and New Zealand only.

The way in was Metabase, a reporting tool Mathspace ran on its own servers. BleepingComputer reported that the same Metabase flaw was used against Framework, Tally and Trezor’s shipping provider in the same weeks, and that the ShinyHunters extortion group has been linked to that campaign. Mathspace has not attributed its own breach to anyone.

The Mathspace data breach, day by day

6 August: Metabase publishes a critical advisory and a patch. Mathspace says its vulnerability-notification process did not flag it.
10 August: the attackers are inside the reporting system.
27 August: they download the Australian reporting database.
29 August: Mathspace updates Metabase, 23 days after the patch.
3 September: Mathspace finds the earlier access while reviewing logs, takes Metabase offline, revokes its API keys and changes its database passwords.
4 September: schools are told, along with the Australian Information Commissioner, the Australian Cyber Security Centre and New Zealand’s Privacy Commissioner and National Cyber Security Centre.
6 September: Mathspace starts emailing affected people.

Why 23 days mattered

The patch arrived four days before the attackers did. So the gap between 6 August and 29 August is the whole story, and Mathspace says so itself: “At the time of updating, we did not complete the additional compromise checks recommended for potentially affected systems.” In other words, the update closed the door but nobody checked whether someone had already walked through it.

For scale, The Educator notes that Australia’s cyber agency advises patching critical internet-facing systems within 48 hours. That is not a detail for parents to act on. It is the reason the data is out, and the reason a school’s own vendors deserve the question: how fast do you patch?

What the Mathspace data breach exposed

Mathspace says the export included user ID, username, first name, last name, email address, country, time zone, user type, email-verification status, and the dates each account joined, last logged in and was last active. Not every field was present for every person. Passwords, password hashes, single sign-on tokens, academic records and results were not taken.

One line in the notice is easy to miss: “An account does not need to be currently active for information retained in the reporting database to be affected.” So a student who left the school years ago, and the parent account set up for them, can be in the file.

What the fake school email will look like

Put the exposed fields together and the follow-up writes itself. Here is the shape to expect, built only from what is in the file:

It knows your name and your role. “Dear Priya, as a parent on Mathspace…” The user type field says parent, student or teacher, so the message can be written for exactly who you are.
It names the school. The file does not link accounts to schools, but a school-issued email address gives the school away, so a teacher’s message can carry the right school name.
It quotes the account. A username or a last-login date (“we noticed you have not logged in since March”) makes it read as if it came from inside the system.
It uses the breach itself. “Confirm your details to secure your child’s account.” Mathspace’s own notice makes the point: be cautious even if a message uses your name or refers accurately to your school or this incident.

Every one of those details can be true, and the message still fake. What it asks for is the tell: a sign-in, a code, a payment or a form. So the steps below are about that ask.

What parents should do now

Do not follow links in any message about Mathspace, your school or this breach. Open the app or the school’s website yourself, from a bookmark or a search.
Check through a channel you already have. Mathspace says to start a new email to data-breach-response@mathspace.co rather than reply to anything you received. For the school, use the portal or phone number you already use.
Never type a password or a verification code into anything that arrived by email or text. A real school does not need you to confirm a code sent to your phone.
If you reused your Mathspace password anywhere, change it there. No password leaked, and Mathspace is not forcing a reset. However, a criminal holding your email address will try it against sites where a password did leak.
Protect your email account first, because it is the reset route into everything else. Use a passkey where you can, an authenticator app otherwise.
Talk to your child before the message arrives. Students got these notices too. Mathspace’s advice to them is to ask a parent, guardian or teacher before acting on any unexpected message. Say it to them this week, in one sentence: “If an email about Mathspace asks you to sign in, show me first.”

For teachers and schools

Teacher accounts are in the file with school email addresses, which makes staff the easiest people to target by name. Tell staff that a Mathspace-themed message asking for a sign-in is expected and fake. Route questions to one person rather than to the app. When you tell parents, send the advice through the channel they already trust from you, not in an email with a link.

How OptMsg changes this exposure

OptMsg would not have prevented the Mathspace data breach. It happened in Mathspace’s systems. What changes is the follow-up. OptMsg’s patent-pending opt-in technology means a message from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. So the fake “message from your child’s school” is not sitting in front of you at 7:30 in the morning, while the school and the app still reach you because you approved them. Only people you approve can reach your inbox. Everyone else goes to Trash.

An OptMsg account also has no password, so a password stolen from another site can’t open your inbox. That does not cover a text to your phone, a phishing page you open yourself, or a school account with its own password; those are the steps above. See how Simple by Design works, or read what opt-in email is and how it shields your inbox.

Ready for an inbox that stays quiet after a breach? Create Your Account.

Your Inbox. Your Rules.

Frequently asked questions

Were my child’s grades or schoolwork exposed in the Mathspace data breach? Mathspace says no. Academic records, learning activities, results and assessment records were not in the stolen data.

My child left the school years ago. Could we still be in the file? Yes. Mathspace says an account did not need to be active for its record to be in the reporting database.

Do I need to change my Mathspace password? Mathspace says passwords and password hashes were not exposed and it is not requiring a reset. If you used the same password on another service, change it there.

How do I know if we are affected? Mathspace began emailing affected people on 6 September 2026 and told schools on 4 September. To check, start a new email to data-breach-response@mathspace.co rather than replying to a message you received.

Would OptMsg have stopped this? No. The breach happened at Mathspace. What OptMsg changes is the aftermath: unapproved senders go to Trash rather than your Inbox, and there is no password on an OptMsg account for a leaked credential to match.