The breached data includes names, email addresses, school names, and user roles. For a subset of affected individuals, additional fields such as phone numbers and student academic records may also have been exposed. Mathspace has stated that it does not store payment card details or government-issued identifiers like Social Security numbers, and it believes the risk of identity theft is limited. Still, the sheer volume of records involved—exceeding one million—places this among the larger edtech incidents in the region.

Affected users should be aware of the following:

• The breach was discovered after unauthorised access to the Metabase analytics dashboard.
• Notifications are being sent directly to impacted users via email.
• The company has engaged external cybersecurity experts and is coordinating with relevant data protection authorities.

Mathspace has urged users to remain cautious of phishing attempts that may reference the incident. It also recommends enabling multi-factor authentication on any accounts associated with the platform, although the compromised data did not include passwords. The company says it has since secured the reporting system and deployed additional monitoring to prevent further unauthorised access.

The disclosure means that for any organisation or family using Mathspace, the immediate concern is not just the exposed records but how quickly the vendor can confirm the full scope of the exfiltration. Given that the data includes academic records, institutions should consider reviewing what information they have shared with third-party learning platforms.

Source: BleepingComputer

Have you or your institution received a breach notification from Mathspace, and how are you approaching the risk related to the exposed academic records?