What should I do immediately after a data breach?

Change your password for the affected account and any other account where you reused that password. Enable two-factor authentication. Monitor your bank and credit card statements. Place a free credit freeze at Equifax, Experian, and TransUnion. If your Social Security number was exposed, file an identity theft report at IdentityTheft.gov.

How long do companies have to notify me after a data breach?

In the US, notification timelines vary by state — typically 30 to 90 days after a breach is confirmed. Under GDPR in Europe, companies must notify regulators within 72 hours. Many states require individual notification "in the most expedient time possible." Companies often delay notification while investigating.

Should I freeze my credit after a data breach?

Yes. A credit freeze prevents new accounts being opened in your name without your explicit unfreeze. It is completely free at all three major bureaus, does not affect your credit score, and does not impact existing accounts. Unfreeze temporarily when you need to apply for credit, then refreeze immediately.

Your Kid's Math App Exposed 1 Million Families to Hackers

Your Child Signed Up. You Got Hacked.

When your kid's school sends home a link to a tutoring app, you fill in your email, create an account, and forget about it. You're not signing up for a security product. You're signing up for homework help. But that account holds your real name, your email address, your location, and now, thanks to a breach at Mathspace, that data belongs to hackers too.

On September 3, 2026, Mathspace, an Australian online maths-tutoring platform used by schools across Australia and New Zealand, confirmed that attackers had broken into its internal analytics system. The intruders first accessed it on August 10. They came back and downloaded data on August 27. Nearly three weeks passed before anyone noticed.

What Did the Attackers Actually Exploit?

They used a security flaw in a piece of software called Metabase. Metabase is a reporting and analytics tool that companies run internally, think of it as a business dashboard for looking at data. Mathspace ran their own self-hosted copy, and they hadn't applied a critical security patch.

The flaw was a SQL injection vulnerability. SQL injection is one of the oldest attack types in existence. Databases speak a language called SQL, and if an application doesn't carefully separate user input from database commands, an attacker can slip in commands disguised as normal input. The database obeys. The attacker gets data.

This particular Metabase vulnerability wasn't new or obscure. Attackers had already used it to breach Framework Laptop, Tally, and Kilo Code in August 2026, the same month Mathspace was first compromised. That pattern points to opportunistic scanning: automated tools crawling the internet, looking for any unpatched Metabase instance, and hitting every one they find. Mathspace was not specifically targeted. It was just vulnerable at the wrong moment.

The fix existed. It hadn't been applied.

How Many People Were Affected?

1,079,819 people had their data downloaded. That includes students, parents, guardians, and school staff across Australia and New Zealand.

The exposed records contain full names, email addresses, usernames, country, time zone, user type, and login dates.

Passwords were not exposed. Academic records, assessment results, and payment data were also not taken. That matters, and it's genuinely good news. But the data that was taken is still useful to bad actors.

A name and email address is the starting point for phishing. Add a time zone and country, and an attacker can craft a convincing, regionally accurate message that looks like it came from your school, your bank, or a government agency. Login dates confirm an account is active, which makes it a more attractive target.

Why Does Your Personal Data End Up Inside a Kids' App?

Schools sign up for platforms. Platforms need a parent contact. You hand over your name and email to receive updates about your child's progress. It feels routine because it is routine. But it means your personal data now lives inside every ed-tech service your child's school adopts, each with its own security posture, its own patch schedule, and its own definition of good enough.

You never consented to a security audit. You consented to homework help.

What to Do Right Now

Check your inbox. Mathspace has been notifying affected users directly. If you or your child has ever used the platform, search your email for a breach notification. No email doesn't mean you were safe, notifications take time.
Stop reusing passwords. Passwords weren't taken in this breach. But if you use the same password across accounts, a separate breach that did expose passwords could now be cross-referenced with this data to unlock your other accounts. A free password manager, Bitwarden, for example, removes the friction of keeping them unique.
Enable two-factor authentication on your email account. Your email is the master key to everything else. If an attacker reaches your inbox, they can reset passwords across every account you own. An authenticator app is stronger than SMS. Both are better than nothing.
Watch for targeted phishing. Expect emails, texts, or calls that reference your child, their school, or educational platforms. Attackers use breach data to make messages feel credible. If something asks you to click a link or confirm payment details, go directly to the source instead of using the link provided.
Consider a credit freeze. The data taken here doesn't include financial details, so direct financial risk is lower. But your email address, combined with data from other breaches, can be enough to open fraudulent accounts. A credit freeze is free in most jurisdictions, and it stops new credit from being opened in your name without your knowledge.
Check haveibeenpwned.com. It's a free service that tracks known breach databases. Enter your email address and it tells you which breaches have included your data and what was exposed. It won't catch everything, but it's a fast and useful baseline.

The Problem Isn't This Breach. It's the System Behind It.

This breach will be patched. Notifications will go out. The news cycle will move on.

But the underlying structure stays the same. Every school that signs your child up for a digital service also signs you up, for whatever security standard that vendor happens to meet. Many of those vendors are not large enterprises with dedicated security teams. They're startups and small companies running self-hosted software they don't always have time to maintain.

The attack on Mathspace was automated. It wasn't personal. A scanning tool found an unpatched server and took what it could carry. One million families are now dealing with the consequences of a patch that was never applied.

Your data didn't end up in hackers' hands because you did something wrong. It ended up there because trust flows downstream in ed-tech, from schools to platforms to you, and the weakest link in that chain is invisible until it breaks.

Do this now:

Search your inbox for any Mathspace communication
Audit accounts that share your email for reused passwords
Enable 2FA on your email account today
Run your email through haveibeenpwned.com
Treat any message referencing schools or ed-tech platforms with extra skepticism for the next 90 days