Loading story…
Mathspace disclosed that unauthorized parties accessed its internal reporting system and downloaded account and contact metadata for 1,079,819 people in Australia and New Zealand, including students, parents or guardians, teachers, and employees. The intrusion was reportedly enabled by CVE-2026-72898, a critical unauthenticated SQL-injection vulnerability in a self-hosted Metabase instance, which allegedly gave attackers administrator access.
The education platform said passwords and hashes, SSO tokens, API credentials, academic records, grades, and learning-activity data were not exposed. Mathspace took the reporting system offline, notified affected schools, education departments, and cybersecurity authorities, and said it is strengthening vulnerability-advisory escalation and post-patch validation processes.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Mathspace published an official disclosure of the Metabase-related breach affecting 1,079,819 people, describing the exposed account metadata and stating that passwords, credentials, SSO tokens, academic records, and API tokens were not exposed. It reported containment measures including revoking Metabase API keys, disabling Metabase access to Snowflake environments, changing Cloud SQL passwords, and preserving logs and application-database evidence for investigation.
Mathspace began emailing school contacts about the data breach.
A review of historical access logs confirmed unauthorized access had occurred before the Metabase patch was applied. Mathspace confirmed the security incident affecting 1,079,819 people in Australia and New Zealand.
Mathspace updated the self-hosted Metabase instance affected by CVE-2026-72898. The company did not initially perform additional compromise checks recommended for systems exposed during the vulnerable period.
Attackers downloaded data from Mathspace's internal reporting system, including account and contact metadata for affected users.
Unauthorized access to Mathspace's Australian internal reporting database began while its self-hosted Metabase instance was vulnerable.
Metabase reportedly disclosed CVE-2026-72898, an unauthenticated SQL-injection flaw in its password-reset API rated CVSS 10.0, and released patches. CISA reportedly added the vulnerability to its Known Exploited Vulnerabilities catalog shortly afterward.
Mathspace took the affected reporting system offline and notified schools, education departments, and cybersecurity authorities. It said it was revising vulnerability-advisory escalation and post-patch verification procedures following the incident.
The ShinyHunters extortion group claimed responsibility for hacking Metabase shortly after patches for CVE-2026-72898 were released. The claim concerns Metabase and does not attribute the Mathspace intrusion to the group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityweek.com
Open sourcehelpnetsecurity.com
Open sourceteiss.co.uk
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceblog.mathspace.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Instructure's Canvas learning platform was reportedly breached after attackers used a **stored cross-site scripting (`XSS`) payload** embedded in a support ticket attachment, which executed when a support representative opened it. The intrusion was attributed to **ShinyHunters**, which allegedly hijacked the employee's authenticated session and used it to exfiltrate data tied to thousands of educational institutions, affecting an estimated **275 million students**. Reporting on the incident says Instructure detected suspicious API activity on April 29, revoked access by April 30, and later faced scrutiny over weak browser-side protections, broad session scope, and unsafe rendering of untrusted content. The attackers were also reported to have exploited a second stored `XSS` flaw in Canvas discussions to gain administrator-level access and deface about **300 school login portals** with ransom messages during finals and AP exams. The fallout included a **Federal Student Aid** security alert, a congressional inquiry, and claims that Instructure later shut down its **Free-for-Teacher** program permanently. Separate reporting also said the company reached an agreement with the attackers amid reports of a **$10 million ransom payment**, turning the incident into one of the most consequential education-sector breaches tied to application-layer trust failures.
Jun 29, 2026
Metabase disclosed a **critical unauthenticated SQL injection zero-day** affecting `1.58+` that was actively exploited against Metabase Cloud tenants and vulnerable self-hosted deployments. The company said the flaw could give remote attackers administrator access and enable theft of stored database credentials and accessible data; it has since blocked the attack paths and released fixes. Metabase rated the issue `CVSS 10.0` and urged self-hosted customers to upgrade, revoke sessions, rotate credentials, and review logs for signs of compromise. The downstream impact has already hit multiple organizations. Framework told customers that attackers breached its Metabase-hosted cloud instance through the upstream provider and stole personal data affecting **all customers**, including names, email addresses, phone numbers, and physical addresses, but not payment information. Tally separately said an attacker accessed its Metabase analytics service and obtained user email addresses and password hashes, while stating that forms and submitted responses were stored separately and were not accessed. LexisNexis also reported disruption and unusual activity involving systems connected to its Metabase API through a third-party vendor.
Sep 3, 2026
Security researchers identified critical vulnerabilities in educational institution web applications, enabling unauthorized access to sensitive student data. In one case, a penetration tester discovered a SQL injection flaw in an educational website's receipt download endpoint, which allowed the attacker to enumerate university numbers, exploit the vulnerability using `sqlmap`, and ultimately dump the database containing personally identifiable information (PII) of students. Attempts to escalate the attack to an OS shell were unsuccessful due to insufficient permissions, but the exposure of student records highlights the severity of the flaw. Another incident involved a manual penetration test against a major university's web infrastructure, where the tester bypassed automated tools and used manual techniques to identify and exploit weaknesses in a subdomain's registration functionality. The attacker was able to register as a non-member, receive verification codes, and gain deeper access, demonstrating the risks posed by insufficient input validation and weak authentication mechanisms in academic environments. These incidents underscore the ongoing threat of SQL injection and the need for robust security controls in educational sector web applications.
Jul 12, 2026