More than a million students, parents and guardians, and school teachers have had personal data such as names and email addresses stolen in a major cyberattack on a learning provider.
Online maths education support program Mathspace confirmed in a blog post written by chief technical officer Alvin Savoy that on between August 10 and August 27, “unauthorised parties” were able to access an internal reporting system after a security patch had not been installed.
Mathspace has been hit with a major cyberattack. Mathspace
Data the hackers snatched up includes user ID, username, first name, last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date, and date joined.
Not every victim had all those fields of data stolen, Mathspace said in their post.
No academic records, learning activities, results, assessment records, passwords (hashes), authentication tokens, SSO credentials, or API credentials were exposed, Mathspace said.
“The exposed data did not include records linking user accounts to their schools,” the post read.
“However, for schools with identifiable email domains, we understand this may be possible.”
Mathspace said the identity of the hackers was unknown but they had “no evidence so far” the data had been published, distributed, or sold.
A total of 1,079,819 people across Australia and New Zealand were affected.
“Names, email addresses and account details can make impersonation attempts more convincing,” Mathspace said.
“Someone may use them to send a message that appears to come from Mathspace, your school or another organisation you know.”
People are urged to check unexpected messages independently, and to not pass on passwords or verification codes in response to a message.
If unsure, people are urged to respond to an organisation purporting to contact them via contact details listed on an official site, rather than hitting “reply” directly on a message.
“Watch for unusual account activity. Pay attention to unexpected password-reset emails or changes to your account details,” Mathspace said.
Anybody whose Mathspace password is the same as a password on another account, is advised to switch the second to a unique password.
Mathspace has notified affected schools, cyber-authorities, and education departments in Australia and New Zealand and is now working on contacting individuals.
The perpetrators of the cyberattack are unknown. Getty Images/iStockphoto
Anybody wishing to check whether their data has been affected can contact Mathspace by emailing data-breach-response@mathspace.co or using support channels provided on the Mathspace website.
The compromised internal reporting service has since been taken down.
“We’re truly sorry this happened and are taking steps to prevent similar breaches in the future,” the blog post read.
“Protecting the information entrusted to us by students, families and schools is our responsibility.“