A maths homework app just lost the details of a million students, parents and teachers

Mathspace is the sort of software a child uses without anyone thinking about it. Schools across Australia and New Zealand hand it out for maths homework, the login gets saved in the browser on the family PC, and that is the last conscious decision anyone makes about it. On 7 September the company published the size of its breach: 1,079,819 students, school staff and parents.

The timeline is the part worth reading slowly. Metabase, a reporting tool Mathspace ran on its own servers, published a critical security patch on 6 August. An attacker used the unpatched flaw to get administrator access on 10 August, downloaded the database on 27 August, and Mathspace installed the update on 29 August, two days after the data had already left. The intrusion was only confirmed on 3 September. The company puts it down to an internal oversight in how vulnerability notices were handled, which is a tidy phrase for a queue nobody read.

What was taken is names, usernames, email addresses, user type, country, time zone and login dates. Passwords, single sign-on tokens and academic records were not exposed, and Mathspace says it has seen no sign of the data being sold or published. Still, a list of children's names paired with school email addresses is a phishing kit ready to go. The one symptom to take seriously is a password reset email nobody asked for. If that arrives, do not click anything in it; go to the site yourself and check the account. And if the same password protects your child's email as well as their homework app, change it today.

Family PCs collect logins nobody remembers making. Tendvane's Privacy and accounts check lists what is signed in on the machine, which is a quick way to find out which accounts actually exist before you go looking for the ones that matter.