Massive Data Leak Hits Mathspace Users Across Schools

A cyber‑attack on Mathspace's internal analytics platform has exposed personal data belonging to more than one million individuals, including students, teachers, school staff and parents, according to a report from SecurityWeek.

The breach originated from a self‑hosted instance of Metabase, an open‑source business intelligence tool that the education technology company uses to aggregate and visualise user information. Hackers accessed the database, extracting names, email addresses and other identifiers tied to the platform's users.

Mathspace, which provides digital math tutoring and assessment tools to K‑12 schools, confirmed the incident after being alerted by its security team. While the company has not disclosed the exact timeline of the intrusion, it indicated that the compromised data set spans several years of operation, potentially affecting current and former users alike.

Education officials and privacy advocates stress that the exposure of such a large volume of personally identifiable information could have far‑reaching consequences. Students' academic records, parents' contact details and staff employment information are now vulnerable to phishing, identity theft and other malicious activities.

In response, Mathspace has taken the Metabase instance offline, initiated a forensic investigation with third‑party cybersecurity experts, and begun notifying affected individuals. The firm also pledged to review its data‑handling practices and strengthen encryption and access controls across all its systems.

Regulators may scrutinise the breach under data‑protection laws such as the U.S. Children’s Online Privacy Protection Act (COPPA) and, where applicable, the European Union’s General Data Protection Regulation (GDPR). Authorities could impose fines or require remedial actions if the company is found to have inadequately protected the data. Meanwhile, schools that rely on Mathspace are advised to alert their communities, encourage password changes and monitor for suspicious activity.