aviatrix logoAviatrix
Under Active Attack

Executive Summary

On August 10, 2026, threat actors exploited a critical SQL injection vulnerability in Mathspace's self-hosted Metabase instance, gaining administrator access and stealing personal data from over 1 million students, staff, and parents across Australia and New Zealand. The attack was executed by the ShinyHunters extortion gang, who downloaded the data on August 27 before the breach was confirmed on September 3. This incident was part of a broader campaign targeting multiple organizations' Metabase installations worldwide, affecting companies including Trezor, Framework, and Tally.

This breach highlights the critical importance of securing internal reporting systems and data analytics platforms, as threat actors increasingly target business intelligence tools that often have broad database access. The incident demonstrates how zero-day vulnerabilities in widely-used SaaS tools can be weaponized at scale, creating cascading impacts across multiple organizations simultaneously.

Why This Matters Now

Educational technology platforms are increasingly targeted as they contain vast amounts of sensitive student and family data, while organizations struggle to secure complex third-party integrations and self-hosted business intelligence tools that often lack robust security controls.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Personal information of students, staff, and parents from Australia and New Zealand was stolen, but academic records, passwords, and authentication tokens were not compromised.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly constrained the attacker's ability to exploit the SQL injection vulnerability and traverse Mathspace's internal systems. The segmented architecture would likely have reduced the blast radius from over 1 million exposed records by isolating the compromised Metabase instance from critical database resources.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The compromised Metabase instance would likely have been contained within its designated security perimeter, potentially limiting the attacker's ability to reach sensitive database systems and reducing their administrative scope across the broader infrastructure environment.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely have restricted the elevated privileges to the immediate Metabase workload context, potentially preventing the administrator access from extending to connected database systems and reducing the scope of accessible resources.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely have blocked or significantly constrained unauthorized database connections from the compromised Metabase instance, potentially preventing direct access to the Australian reporting database and reducing the attacker's reconnaissance capabilities.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Enhanced visibility controls would likely have detected the anomalous 17-day persistence pattern and unusual database access behaviors, potentially triggering automated response mechanisms that could have constrained the attacker's operational timeline and reconnaissance activities.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security controls would likely have blocked or significantly constrained the large-scale data download attempt, potentially preventing the bulk extraction of over 1 million records and limiting the attacker's ability to transfer sensitive personal information outside the secure environment.

Impact (Mitigations)

While some personal data exposure might still have occurred through the initial compromise, the overall impact would likely have been significantly reduced from 1,079,819 affected individuals to a much smaller subset, limiting regulatory exposure and privacy violations across the educational platform.

Impact at a Glance

Affected Business Functions

  • Online Learning Platform
  • Student Information Management
  • Educational Content Delivery
  • Parent-Teacher Communication Portal
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Personal information of 1,079,819 individuals including students, parents, guardians, and school staff from Australia and New Zealand. Data included names, email addresses, and potentially school affiliations but excluded academic records, passwords, authentication tokens, or assessment data.

Recommended Actions

  • • Implement Zero Trust segmentation to isolate internal reporting systems from broader network access and limit blast radius of application vulnerabilities
  • • Deploy egress security controls with policy enforcement to detect and prevent unauthorized data downloads from internal databases to external destinations
  • • Enable multicloud visibility and control to monitor anomalous database access patterns and suspicious data export activities across internal systems
  • • Establish encrypted traffic inspection capabilities to detect SQL injection attempts and malicious payloads targeting application vulnerabilities
  • • Implement threat detection and anomaly response systems to identify persistent unauthorized access and extended dwell times in critical data systems

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image