Privacy
Mathspace Breach: Protecting Students, Families, and Schools From Follow-On Scams
A privacy and safety response guide for the Mathspace breach, with emphasis on trusted communications, personalized phishing risk, reused-password exposure, and child-appropriate escalation.
Mathspace reported unauthorized access on 10 August 2026 and data download on 27 August, then confirmed the breach on 3 September and began individual notifications on 6 September. The company reported 1,079,819 affected students, parents or guardians, teachers, and staff in Australia and New Zealand.
What was reported exposed
Mathspace reported that affected fields can include names, email addresses, internal user or account details, country, timezone, user type, verification status, and login or activity dates; field availability varies by person. It said academic records, learning activities, results, password hashes, tokens, SSO credentials, API credentials, and direct school-linkage records were not exposed.
Mathspace said identifiable email domains may still permit school inference. It also said it had no evidence at the time that the data had been published, sold, or misused. Those are investigation boundaries, not guarantees against future misuse.
Protect affected communities without amplifying scams
Verify breach notices through known Mathspace or school channels, not links in unsolicited messages. Prepare students, parents, teachers, and staff for personalized phishing, fake school-support calls, and password-reset lures that use exposed context.
Change passwords that were reused on unrelated services, enable MFA where available, monitor for unexpected account changes, and ensure children have a clear path to escalate suspicious contact to a trusted adult or school administrator.
A communication principle for schools and families
Use a trusted, independently reachable communication channel and explain what a legitimate support request will and will not ask for. Never treat an unexpected call, message, password-reset request, or MFA prompt as proof that it is connected to a genuine breach response.