Mathspace online data breach#

Mathspace, an online education software product, has reported a cyber-attack to their platform that resulted in a data breach of over one million users across Australia and New Zealand. While it is not a Ministry of Education product we consider it is of sufficient concern to schools to provide a heads up.

There are 2 types of users that may be affected by this breach:

• Schools that have a paid subscription so it can be used by several classes.
• Individuals who have signed up to a free version to use the tool on their own or with their class.

We believe that the breach may have included private information, such as names and email addresses of students and teachers who have used the tool.

Mathspace has advised that it has notified the Office of the Privacy Commissioner and the National Cyber Security Centre, and has begun contacting the affected account holders. Talk to your staff to see if they have used Mathspace or received an email.

Recommended actions for affected schools#

• Review the Office of the Privacy Commissioner’s guidance on privacy breaches, including how to assess whether a breach is likely to cause serious harm and when notification obligations apply. The guidance also outlines what information should be provided to affected individuals, including parents, caregivers, or students where appropriate. Each school is responsible for assessing its own circumstances and determining what actions are required under the Privacy Act 2020.

Breach management – Privacy commissioner

• Reset Mathspace passwords for all users in the school.
• If that password is re-used on other systems, reset that password to a new unique password.
• Check that the passwords on your email accounts are strong and unique. You can enforce this with a password policy.
• Make sure student passwords are easy for them to remember, but not easy for others to guess. For example, do not use 12345678 or the student's name as passwords.
• Talk to your IT administrator about restricting sign-ins so that staff and students can only access school accounts from New Zealand or approved locations, such as your school network.