Mathspace hack: More than one million students, parents and teachers impacted in major data breach
More than one million people across Australia and New Zealand have been caught up in a major data breach after hackers accessed an internal system.
More than one million students, parents, guardians and teachers across Australia and New Zealand have been caught up in a major data breach after hackers gained access to an internal Mathspace system.
The online maths learning platform, which is used by schools to deliver lessons, set work and monitor student progress, said 1,079,819 people were affected.
Mathspace said unauthorised parties accessed an internal reporting system between August 10 and August 27, during a period when a security patch had not been installed.
Sign up to The Nightly's newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.The company said the stolen information may have included names, usernames, email addresses and other account details.
However, Mathspace stressed that not every affected person had all types of information exposed.
The data potentially accessed included user IDs, usernames, first and last names, email addresses, country, time zone, user type, email verification status, last active date, last login date and date joined.
More sensitive information was not accessed, according to Mathspace.
The company said there was no access to academic records, learning activities, results, assessment records, password hashes, authentication tokens, single sign-on credentials or API credentials.
Mathspace chief technical officer Alvin Savoy said the exposed information did not directly connect user accounts with their schools.
“However, for schools with identifiable email domains, we understand this may be possible,” Mr Savoy said.
The company said it did not yet know who was responsible for the breach and had found “no evidence so far” that the stolen information had been published, shared or sold.
Despite the limited nature of the exposed information, Mathspace warned it could still be used in targeted scams or impersonation attempts.
“Names, email addresses and account details can make impersonation attempts more convincing,” Mr Savoy said.
“Someone may use them to send a message that appears to come from Mathspace, your school or another organisation you know.”
Affected users have been urged to be cautious about unexpected emails and messages, particularly those asking for passwords, login details or verification codes.
Mathspace advised people who are unsure about a message to contact the relevant organisation using official contact details found on its website, rather than responding directly.
Users have also been told to monitor their accounts for unusual activity, unexpected password-reset emails or changes to their account information.
Anyone who reused their Mathspace password on another service has been advised to change that password and use a unique password instead.
Mathspace said it had notified affected schools, cyber authorities and education departments in Australia and New Zealand and was contacting people whose information may have been involved.
The internal reporting system accessed during the breach has since been shut down.
“We’re truly sorry this happened and are taking steps to prevent similar breaches in the future,” Mr Savoy said.
“Protecting the information entrusted to us by students, families and schools is our responsibility.”
