Mathspace's self-hosted Metabase instance was compromised via a known critical SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) exploited as a zero-day before patching. The attackers gained unauthorized access starting August 10, 2026, and downloaded personal data of 1,079,819 users by August 27. The exposed data included identifying information such as names, user IDs, email addresses, and login metadata, but excluded academic records, passwords, authentication tokens, and API credentials. Mathspace delayed patching until August 29, after the breach had occurred, and did not complete recommended compromise checks. The breach was claimed by the extortion group ShinyHunters. Mathspace has since taken the Metabase instance offline, revoked API keys, disabled database accounts, changed passwords, and is conducting a forensic investigation.

The breach exposed personal identifying information of over one million users, including students, teachers, staff, and parents/guardians, which could facilitate phishing or social engineering attacks. No sensitive academic or authentication data was compromised, reducing the risk of direct account takeover or academic fraud. The delayed patching and incomplete incident response increased exposure duration and risk. The breach affects privacy and may lead to targeted phishing campaigns against affected individuals.

Mathspace has taken the affected Metabase instance offline, revoked API keys, disabled database access accounts, changed passwords, and exported logs for investigation. The critical SQL injection vulnerability (CVE-2026-72898) was patched on August 6, 2026. Organizations using Metabase should ensure they apply this patch promptly and perform recommended compromise checks. Affected individuals should be cautious of phishing attempts referencing this breach. No further immediate action is indicated as the vulnerability is patched and the compromised system has been secured.