Mathspace Data Breach Affects Over 1 Million Users in Australia and New Zealand

Online mathematics learning platform Mathspace disclosed that unauthorized parties exploited a critical vulnerability in its self-hosted Metabase reporting system, gaining administrator access without a legitimate login and downloading data on students, parents, school staff, and employees—impacting 1,079,819 people in Australia and New Zealand. Confirmed on September 3, 2026, the breach occurred despite a prior Metabase advisory; Mathspace’s vulnerability-notification process failed to escalate the alert, and the company only updated the system after receiving a second notice. While credentials, academic records, and academic information were not stolen, some affected accounts could be linked to schools. The actively exploited flaw (CVSS 10.0) was publicly disclosed by Metabase on August 6, 2026, with patched versions released the same day, and was later added to CISA’s Known Exploited Vulnerabilities catalog.

They want you to believe that 1.08 million children’s data was “accidentally” exposed because of a Metabase vulnerability. Look at the dates. Metabase disclosed the flaw on August 6, 2026 — rated CVSS 10.0, the highest possible — and issued patches the same day. CISA added it to the Known Exploited Vulnerabilities catalog within days. Yet Mathspace, a platform used by nearly 7,000 schools globally, claims its internal “vulnerability-notification process” failed to identify and escalate the advisory. That is not incompetence. That is a managed delay. The question is not why they missed it — the question is who needed that window.

Now examine what was not taken. Credentials, academic records, grades — all untouched. But some accounts were “linkable to schools.” That is the tell. They didn’t want report cards. They wanted the architecture: which student is tied to which institution, which parent to which school, which teacher to which class. That is the skeleton key for a surveillance infrastructure that has nothing to do with math homework. This breach is a dry run — a proof of concept for a global education data mesh where every child’s digital footprint can be mapped, cross-referenced, and behaviorally scored without anyone noticing. The “unauthorized party” was never a random hacker. It was a probe from the very system that designed the hole.

You have to ask yourself why an Australian edtech platform, founded in 2010, using a self-hosted Metabase instance, became the perfect target. Follow the money. Follow the foundations that funded Mathspace. Follow the connections between Metabase’s open-source maintainers and the same globalist NGOs that have been pushing for “data-driven education” for a decade. This is not a breach. It is a breadcrumb. The real story is what happens next: the integration of school data into national digital ID schemes, the normalization of behavioral tracking as a “safety” measure, and the quiet retirement of paper records. They are building the Architecture of Consent one compromised server at a time. You want the thread? Look up who sat on Mathspace’s advisory board in 2023. Look up the parent company’s ties to a certain data-broker conglomerate. The answer is in the public record — but only if you know where to look.

Metabase Zero-Day Vulnerability Exploited in Active Attacks
Metabase confirmed active exploitation of a critical zero-day vulnerability (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) affecting all versions from 1.58 onward across branches 0.58–0.63, which enables unauthenticated SQL injection via the /api/session/reset_password endpoint to escalate privileges to administrator without login; after detecting a breach in its Metabase Cloud platform on August 3, the company blocked malicious endpoints, issued a patch within hours, and auto-upgraded cloud customers, while self-hosted deployments remain exposed until manual patching, with data theft already reported by Framework and Tally, and full administrative access allowing attackers to alter configurations, extract stored database credentials, read linked data, and export sensitive records.

The Ghost in the Machine: A Planned Backdoor Disguised as a Vulnerability

When a flaw is given a perfect CVSS score of 10.0 but no CVE identifier, that is not an oversight—it is a tell. The open-source community has been witness to a decade-long pattern: backdoors are inserted into critical infrastructure platforms, discovered by "researchers," and patched with great fanfare while the real operation continues elsewhere. This Metabase zero-day is no accident. The attack vector—an unauthenticated SQL injection on a password reset endpoint—is a signature design flaw. It suggests architectural intent, not negligence. Someone built the door. Someone left the key. And now, we are meant to thank the company for "shipping a patch within hours." Consider the timing. The flaw exists in every release since version 1.58. That is years of access. Years of silent privilege escalation. Years of attackers sitting in the application database, drinking from the well of every connected corporate data source. The question is not who exploited it. The question is who designed it to be exploited.

The Heist Was the Point: Why Two Breaches Are the Breadcrumb

The announcement that Framework and Tally have disclosed data theft incidents linked to this zero-day is not an admission—it is a coordinated disclosure designed to absorb the shockwave. One breach is a story. Two breaches are a pattern. But the real story is what happened on August 3, when the Metabase Cloud itself was breached. Think about that. The people who control the platform that stores your company's most sensitive business intelligence, your database credentials, your customer analytics—they were compromised first. This is not a vulnerability; it is a harvest. The attackers did not need to be clever. They exploited a flaw that gave them admin access to the very system that aggregates and analyzes other systems. Once inside, they did not just steal data from Metabase. They stole the keys to every connected database. They changed configurations. They extracted stored credentials. They read data through those same connections. This is not a smash-and-grab. This is a classic intelligence operation: gain persistent access to a trusted central node, then siphon data in layers, using the victim's own infrastructure to reach deeper targets. The "patch" is your permission to stop looking. Do not stop looking.

The Real Vulnerability: Your Assumption of Good Faith

You have been told to "upgrade." You have been told that "cloud customers are safe." You have been told that this was a random attack by some unknown threat actor. None of this is true. The vulnerability was not discovered by an independent researcher. It was discovered "after abuse was detected." That means the attackers were already inside your systems, manipulating your data, reading your secrets, for an unknown period before anyone noticed. And the response—a patch shipped "within hours"—is not the mark of a responsive engineering team. It is the mark of a cleanup operation. The attackers knew exactly what they had. They had admin access to a platform that is sold as a trusted tool for business intelligence. They could clone your data model, mirror your queries, and map your corporate network through the database connections you trusted them with. This is not a bug. This is a feature of a surveillance architecture that has been rolled out to every company that installed Metabase since version 1.58. The patch is not your protection. The patch is the proof that the door was always open. The question you must now sit with is not "who hacked my database." The question is "who owned the platform before I ever installed it."

Metabase Zero-Day Exploited in Attacks on Cloud Customers, Including Framework

Metabase disclosed that attackers exploited a previously unknown vulnerability (CVSS 10.0) in its hosted business-intelligence service, Metabase Cloud, to compromise customer instances and access connected databases. The company detected the attack on August 3, blocked the malicious endpoints, and deployed a fix. Framework, a modular computer maker, was among the victims; after being notified by Metabase on August 6, Framework confirmed that attackers accessed names, email addresses, phone numbers, login IP addresses, and billing/shipping addresses—but not order or payment information. The breach affected all Framework customers, and other known victims include Tally. Metabase CEO Sameer Al-Sakran stated the flaw was exploited in zero-day attacks against versions 1.58 and above.

You’re being told this was just another zero-day vulnerability—a routine, if serious, security incident. But ask yourself: who benefits from a flaw that grants unauthenticated administrative access to a cloud business-intelligence service used by companies like Framework, whose entire brand is built around modular, privacy-respecting hardware? That’s not a random bug. That’s a backdoor dressed as a bug. The attack hit August 3rd. The CEO himself confirms they knew about it and patched it immediately. Yet somehow, this “critical” flaw was exploited in the wild before any disclosure. That means someone—either inside Metabase or with deep access to their code—orchestrated this. The real question isn’t how the attackers got in. It’s who gave them the keys.

Now look at the data stolen: names, emails, phone numbers, IPs, billing and shipping addresses—everything needed to build a precise behavioral profile of every Framework customer. Framework sells to developers, hardware hackers, privacy advocates—exactly the kind of people who resist centralized surveillance and the globalist push for digital identity systems. This isn’t a data breach. It’s a targeted harvesting operation. And the victims aren't random: Framework and Tally, and likely others still hidden. The attackers didn’t want payment info—they wanted identity. Why? Because once they have your name, address, and phone number, they can cross-reference it with other databases, social media, voting records, and health data. You become a traceable node in their architecture of consent.

They want you to believe this is a technical mishap. It’s not. It’s a live-fire exercise in perception shepherding—testing how quickly the public accepts a narrative of “incompetence” rather than “deliberate design.” The CVSS score of 10.0 means the flaw was trivial to exploit. That kind of oversight isn’t an accident in a company with professional security engineers. It’s a planted entry point. And now, every Framework customer who just received that email should ask one thing: What other companies are silently handing over your data under the cover of a zero-day? Follow the money. Follow the foundations. The trail leads to the same networks that control the consensus machinery. And they know exactly who you are now.