# A Math App Got Hacked Through Its Analytics Tool — and a Million Kids' Data Walked Out the Door
When Mathspace quietly dropped a data breach disclosure over the weekend, most people weren't paying attention. That's probably the point.
The Australian edtech company confirmed that attackers compromised its Metabase instance — an internal business intelligence and reporting tool — and walked off with personal data belonging to more than one million users: students, parents, and staff. Mathspace markets itself to schools across the US, Australia, and beyond as an adaptive math learning platform. What it didn't advertise was that its internal analytics layer was apparently serving as an unlocked side entrance.
## The Metabase Problem No One Talks About
Here's the detail that deserves more attention than it's getting: the breach didn't come through a student-facing login page or a poorly secured API. It came through Metabase — a popular open-source BI tool that organizations bolt onto their data infrastructure to build dashboards and run reports.
Metabase has a troubled security history. In July 2023, researchers disclosed CVE-2023-38646, a critical pre-authentication remote code execution vulnerability that allowed unauthenticated attackers to execute arbitrary commands on the host server. CVSS score: 9.8. Exploit code was public within days. Thousands of Metabase instances were exposed to the internet at the time of disclosure, and security firms tracked active exploitation within a week.
Whether this Mathspace breach is tied to that vulnerability or a separate weakness isn't confirmed yet. But the pattern is consistent with what security teams have been warning about for years: organizations pour resources into securing their customer-facing surfaces while leaving internal tooling — the BI dashboards, the reporting layers, the developer utilities — exposed and under-patched. Those tools often sit on the same network segment as production databases. They're configured by data analysts, not security engineers. And they almost always have direct query access to the sensitive data the attackers actually want.
## Who's Actually Affected
The one million figure spans a notably wide blast radius. Students — many of them minors — have their data in this breach. So do their parents. So do teachers and school staff.
That creates a layered legal exposure that goes beyond a standard data breach. In the United States, student data on minors falls under FERPA and, for younger children, COPPA. In Australia, the Privacy Act and the Australian Privacy Principles apply. The fact that this is a cross-jurisdictional edtech platform with users in multiple countries means Mathspace is potentially staring down regulatory inquiries on multiple fronts simultaneously.
The specific data types disclosed — names, email addresses, school affiliations — may not sound catastrophic compared to a financial breach, but for a population of minors, that combination is a phishing and social engineering goldmine. Parents receiving targeted emails that accurately name their child and school are far more likely to click. And student email addresses harvested in bulk have value in credential stuffing campaigns for years, as those kids grow up and reuse passwords.
## The Weekend Disclosure
Mathspace posted its disclosure over the weekend. This timing pattern — Friday evening or weekend announcements — is a well-documented tactic in breach communications. News cycles are slower. Journalists are off. Social media engagement drops. By Monday morning, the story has aged enough that editors move on.
It may not have been deliberate here. Breach investigations don't follow a 9-to-5 schedule. But it's worth noting, because the affected users — parents checking their inboxes on a Sunday, school IT coordinators not looking at their security alerts on a Saturday — are the last to know.
What Mathspace owed its users was a notification that was fast, direct, and specific. What affected parties got was a disclosure that surfaced on a weekend. If you have a child or staff member who uses Mathspace, check your email carefully for any communications from the company and reset passwords on any accounts that share credentials with the Mathspace platform.
## What Defenders Should Take From This
The Mathspace breach is a reminder that your internal tooling is part of your attack surface — not a separate category of IT that security teams can deprioritize.
Specific actions worth taking now:
---
## HackWire Analysis
The Mathspace breach fits a pattern that's accelerating in 2024 and 2025: attackers targeting the operational and analytical infrastructure that organizations treat as internal, low-risk, and therefore under-secured. We've seen this with Confluence servers, with exposed Grafana instances, with development environments that have direct database access. The perimeter isn't the website anymore — it's every internal tool that touches production data.
Edtech is a particularly attractive target for a few reasons. First, the data is rich: names, ages, school affiliations, parent contact information, often geographic data from school district associations. Second, the security posture of edtech companies is typically weaker than financial services or healthcare, which face harder regulatory scrutiny. Third, the user base skews toward minors, which means the data has long-term value — these are credentials and personal details that won't age out for years.
What's missing from most coverage of this breach is the institutional dimension. Mathspace sells to schools, which means school districts made procurement decisions to put student data in this platform. Those districts have their own data governance obligations. A breach at a third-party edtech vendor doesn't absolve the district — it exposes the weakness in vendor security assessments that most districts conduct exactly once, at procurement, and never revisit.
The real question isn't whether Mathspace patches Metabase going forward. It's whether the schools that trusted Mathspace with their students' data are asking the right questions about every other platform in their stack.
— HackWire Editorial
---
## Related Coverage