{"id":1049288,"date":"2026-09-07T18:09:24","date_gmt":"2026-09-07T18:09:24","guid":{"rendered":"https:\/\/www.europesays.com\/us\/1049288\/"},"modified":"2026-09-07T18:09:24","modified_gmt":"2026-09-07T18:09:24","slug":"mathspace-data-of-more-than-one-million-people-exposed-during-breach","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/us\/1049288\/","title":{"rendered":"Mathspace: Data of more than one million people exposed during breach"},"content":{"rendered":"

The personal data of more than one million students, parents, guardians and school staff in Australia and New Zealand<\/a> has been exposed during a cyber security<\/a> attack on online learning platform Mathspace.<\/p>\n

\u201cUnauthorised parties\u201d accessed an internal reporting system in August to swipe names, email addresses and user IDs, among other information.<\/p>\n

Mathspace staff records were also affected. <\/p>\n

Know the news with the 7NEWS app: Download today Arrow<\/a><\/p>\n

\u201cWe\u2019re truly sorry this happened and are taking steps to prevent similar breaches in the future,\u201d the company\u2019s chief technology officer Alvin Savoy said.<\/p>\n

\u201cProtecting the information entrusted to us by students, families and schools is our responsibility.\u201d<\/p>\n

Savoy said there is no evidence the data has been \u201cpublished, distributed, sold or otherwise misused\u201d.<\/p>\n

\u201cIdentity of the attacker remains unknown,\u201d he said.<\/p>\n

Savoy said customer passwords, academic records and results, single sign-on tokens and other customer authentication credentials were not exposed during the digital breach.<\/p>\n

\"TheThe personal data of more than one million students, parents, guardians and school staff in Australia and New Zealand has been exposed. Credit: 7NEWS<\/p>\n

Hackers were able to obtain administrator access to software used for internal reporting as early as August 10, before names and other data was downloaded on August 27.<\/p>\n

The breach was confirmed and the compromised system taken offline on Thursday.<\/p>\n

Authorities in Australia and New Zealand have been alerted, and state and territory education<\/a> departments have been informed.<\/p>\n

\u201cA total of 1,079,819 people were affected, comprising students, staff, and parents or guardians combined. Only people in Australia and New Zealand were affected,\u201d Savoy said.<\/p>\n

Former users may be impacted too, because an \u201caccount does not need to be currently active for information retained in the reporting database to be affected\u201d.<\/p>\n

A \u2018warning\u2019 for every Australian school<\/p>\n

Digidentity managing director Fred Slikker said the latest breach should be a \u201cwarning\u201d for every Australian school using third-party learning platforms.<\/p>\n

\u201cOutsourcing a digital service doesn\u2019t outsource responsibility for student identity data,\u201d Slikker told 7NEWS.com.au.<\/p>\n

\u201cSchools need to know where providers copy that information, including into internal reporting systems, who can access it and how quickly critical security updates are applied.\u201d<\/p>\n

He said contracts should include enforceable requirements to prove that controls are working. <\/p>\n

\u201cChildren and parents shouldn\u2019t be left to manage risks created by systems selected on their behalf,\u201d he said.<\/p>\n

Steve Hunter, director of engineering at cybersecurity and AI company Arctic Wolf, said the Mathspace breach shows organisations need to take \u201ca more risk-based approach\u201d, rather than \u201cplaying whack-a-mole every time a new vulnerability appears\u201d.<\/p>\n

\u201cThis is particularly important in the education sector, where schools, universities and education technology providers can hold large volumes of information relating to students, parents, teachers and staff across a wide range of systems and third-party platforms,\u201d Hunter said.<\/p>\n

Lingering threat from data breaches<\/p>\n

Savoy said the \u201cincident is real\u201d but that not every message referring to it will be genuine.<\/p>\n

Mathspace said caution should be shown and that any email or call relating to the breach should be checked independently.<\/p>\n

It was only in late August that experts warned about the lingering threat Australians face in the wake of recent cyberhacks<\/a>.<\/p>\n

\u201cStolen information can be retained, traded and combined with data from future incidents,\u201d Slikker said.<\/p>\n

\u201cAustralians affected by a breach therefore face a continuing risk of impersonation and identity misuse, even after they have changed their password or replaced a compromised card.\u201d<\/p>\n

<\/p>\n

What experts want Aussies to know about recent cyberattacks<\/p>\n

4 min read<\/p>\n

<\/a><\/p>\n

This is the threat that scares Australia\u2019s former cyber chief most<\/p>\n

3 min read<\/p>\n

<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The personal data of more than one million students, parents, guardians and school staff in Australia and New…\n","protected":false},"author":3,"featured_media":1049289,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[2],"tags":[4740,152690,26271,407,50],"class_list":["post-1049288","post","type-post","status-publish","format-standard","has-post-thumbnail","category-news","tag-australia","tag-cyber-security","tag-cyber-attack","tag-education","tag-news"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@us\/117231104845370159","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts\/1049288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/comments?post=1049288"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts\/1049288\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/media\/1049289"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/media?parent=1049288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/categories?post=1049288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/tags?post=1049288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}