Mathspace Breach via Metabase: How Attackers Looted 1M+ Records Through an Exposed BI Platform — Detection and Hardening Guide

Online mathematics learning platform Mathspace disclosed over the weekend that attackers gained access to its Metabase internal reporting system and exfiltrated data belonging to more than 1 million students, staff, and parents. This is not a ransomware event and not a zero-day spectacle — it is something far more common and, frankly, more preventable: an internal analytics platform that became the soft underbelly of the organization's data architecture.

I have led multiple IR engagements where the initial access vector was a business intelligence or reporting tool — Metabase, Tableau, Redash, Superset — sitting between the internet (or a broadly reachable internal segment) and production databases. These platforms are purpose-built to query everything, which means a single compromised instance hands an attacker a curated, authenticated pathway into your most sensitive data stores. For education technology providers handling children's data, the regulatory and reputational stakes are even higher: FERPA in the US, GDPR-K in Europe, and a growing patchwork of state student-privacy laws.

Defenders need to treat this as a forcing function. If you run Metabase — or any BI layer with direct database credentials — assume it is a target, verify its exposure today, and instrument detection around it.

Technical Analysis

What We Know

• Victim: Mathspace, an online maths learning platform used by schools globally.
• Attack vector: Unauthorized access to the company's Metabase internal reporting system.
• Impact: Data pertaining to 1+ million individuals — students, staff, and parents — was stolen.
• Disclosure: Publicly acknowledged over the weekend; notification and regulatory processes are underway.

Why Metabase Is a High-Value Target

Metabase is an open-source BI platform that organizations deploy to let non-technical staff query production databases through a web UI. From an attacker's perspective, a compromised Metabase instance is functionally equivalent to a compromised database account, with several advantages:

1. Pre-staged credentials. Metabase holds persistent, often highly privileged database connection strings. An attacker who reaches the application layer inherits those connections — no credential theft from the DB tier required.
2. Legitimate query channel. Data access through Metabase generates normal-looking SQL from the database's perspective. Database-level auditing sees the metabase service account running SELECT statements — exactly what it does all day.
3. Built-in export functionality. Metabase natively supports CSV/XLSX/JSON export of query results and entire dashboards via its API (/api/card/:id/query, /api/dataset, /api/dashboard/:id). Bulk exfiltration doesn't require custom tooling — just HTTP requests.
4. Historical attack surface. The Metabase ecosystem has a documented history of severe flaws — including pre-authentication remote code execution issues in its setup and H2 database handling — which means internet-scanning botnets actively fingerprint Metabase instances. An unpatched or setup-token-exposed instance is found within hours of being reachable.

Likely Attack Chain (Defender's Model)

While Mathspace has not released full technical details, intrusions into internal reporting systems in our casework typically follow one of these paths:

1. Exposure: The Metabase instance was reachable beyond its intended audience — directly internet-exposed, behind weak SSO, or reachable from a broadly accessible VPN segment.
2. Initial access: Exploitation of a known Metabase vulnerability, abuse of an incomplete setup flow, session/token theft, or valid credentials from credential stuffing or a prior stealer-log corpus.
3. Discovery: The attacker enumerated connected databases via /api/database and /api/table metadata endpoints.
4. Collection & exfiltration: Bulk query/export of tables containing student, staff, and parent PII via the dataset/card query APIs, followed by download over standard HTTPS — blending into normal egress.

Exploitation Status

No CVE is cited in the disclosure, and we will not speculate on one. The salient fact is confirmed, completed data theft — this is not theoretical risk. Treat any reachable Metabase instance as under active reconnaissance pressure; Shodan/Censys fingerprinting of Metabase is constant.

Detection & Response

The detections below target the behaviors that define this intrusion class: abnormal Metabase API usage, mass export activity, the application spawning unexpected child processes (post-exploitation RCE behavior), and anomalous database query volume from the BI service account. Tune thresholds to your baseline before production deployment.

Sigma Rules

---
title: Metabase Application Spawning Suspicious Child Processes
id: 3f7a1c92-5b84-4e1d-9a27-8c6d2e5f1043
status: experimental
description: Detects the Metabase Java process spawning shells, scripting interpreters, or system utilities — a strong indicator of post-exploitation RCE activity against the BI host rather than normal reporting behavior.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'metabase.jar'
      - 'metabase'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative maintenance wrappers around Metabase startup scripts
level: high
---
title: Linux Metabase Host Spawning Shell or Download Utilities
id: 91d4e2a7-6c35-4f08-b719-2a8e4d7c3056
status: experimental
description: Detects shells, interpreters, or download tools spawned by the Java/Metabase process on Linux hosts, consistent with exploitation of the BI application leading to command execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'metabase.jar'
      - 'metabase'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Container health-check or wrapper scripts explicitly invoking shells under the Metabase service
level: high
---
title: Bulk Data Export via Metabase API Endpoints
id: 5e2b8f14-9d63-4a7c-8310-6f4b9c2d5871
status: experimental
description: Detects repeated requests to Metabase query and export API endpoints from a single source, consistent with automated bulk extraction of query results and dashboard data during a breach.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1530
  - attack.t1567
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/api/card/'
      - '/api/dataset'
      - '/api/dashboard/'
      - '/api/database'
  filter_format:
    cs-uri|contains:
      - '/api/card/1/query'
  condition: selection
falsepositives:
  - Analysts exporting single reports; scheduled dashboard refreshes — baseline per-source request counts and alert on volume anomalies (e.g., >100 export requests per source IP per hour)
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts web/proxy logs (ingested via CEF/Syslog from your reverse proxy, WAF, or the host itself) for anomalous Metabase API usage patterns — high-volume export requests, metadata enumeration, or access from sources outside expected analyst subnets. Pair it with a watchlist of approved BI user source IPs for best fidelity.

// Hunt: Anomalous Metabase API access and bulk export behavior
let MetabaseEndpoints = dynamic(["/api/card/", "/api/dataset", "/api/dashboard/", "/api/database", "/api/table"]);
let ExportEndpoints = dynamic(["/api/dataset/csv", "/api/dataset/xlsx", "/api/dataset/json", "/query/csv", "/query/xlsx"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (MetabaseEndpoints)
| extend IsExport = RequestURL has_any (ExportEndpoints)
| summarize
    TotalRequests = count(),
    ExportRequests = countif(IsExport),
    DistinctEndpoints = dcount(RequestURL),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, RequestClientApplication, Computer
| where ExportRequests > 20 or TotalRequests > 500 or DistinctEndpoints > 50
| extend RiskScore = (ExportRequests * 2) + DistinctEndpoints
| sort by RiskScore desc;

// Companion hunt: source IPs enumerating Metabase metadata with no prior 30-day history
let KnownSources =
    CommonSecurityLog
    | where TimeGenerated between (ago(31d) .. ago(1d))
    | where RequestURL has "/api/"
    | distinct SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/api/database", "/api/table", "/api/field")
| where SourceIP !in (KnownSources)
| summarize Requests = count(), Endpoints = make_set(RequestURL, 10) by SourceIP, DestinationHostName
| sort by Requests desc;

Velociraptor VQL

Use this artifact across your server fleet to identify Metabase instances, their exposure-relevant network listeners, and any suspicious child processes or recently dropped files near the installation — the forensic triage you would run first if you suspect your own reporting tier is compromised.

-- Hunt: Metabase instances, listeners, and suspicious child processes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'metabase'
   OR Exe =~ '(?i)metabase'

-- Map listening ports for any identified Metabase/Java processes
SELECT Pid, Name, Path,
       Family, Type, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)java|metabase'
  AND Status = 'LISTEN'

-- Identify child processes spawned by the Metabase service (post-exploitation indicator)
LET metabase_pids = SELECT Pid FROM pslist() WHERE CommandLine =~ 'metabase'
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN metabase_pids.Pid
  AND Name =~ '(?i)cmd|powershell|pwsh|bash|sh$|curl|wget|python'

-- Recently modified files around common Metabase deployment paths (webshell/dropped tooling)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/opt/metabase/**', '/srv/metabase/**', 'C:/Program Files/Metabase/**'])
WHERE Mtime > timestamp(epoch=now() - 604800)
ORDER BY Mtime DESC

Hardening & Verification Script

Run this Bash script on Linux hosts to verify Metabase version/patch state, confirm the instance is not internet-exposed, and audit local configuration for risky settings.

#!/bin/bash
# Metabase exposure and hardening audit - Security Arsenal
set -euo pipefail

echo "=== [1] Identify running Metabase processes ==="
ps aux | grep -i '[m]etabase' || echo "No Metabase process found."

echo ""
echo "=== [2] Check listening ports bound to 0.0.0.0 (external exposure risk) ==="
ss -tlnp | grep -Ei 'java|metabase|3000' || echo "No Metabase listener detected."
echo "NOTE: Any listener on 0.0.0.0 should be reviewed - bind to loopback or restrict via security group/firewall."

echo ""
echo "=== [3] Verify Metabase version (older versions carry known critical RCE history) ==="
for jar in /opt/metabase/metabase.jar /srv/metabase/metabase.jar /usr/local/metabase/metabase.jar; do
  if [ -f "$jar" ]; then
    echo "Found: $jar"
    unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | grep -i implementation-version || echo "Version not extractable - check your deployment package."
  fi
done

echo ""
echo "=== [4] Check for internet reachability from egress test ==="
curl -s --max-time 5 ifconfig.me > /dev/null && echo "Host has outbound internet. Confirm INBOUND path is blocked: your Metabase port must not be reachable from the internet (check LB, security groups, NACLs)."

echo ""
echo "=== [5] Audit local firewall for the Metabase port (default 3000) ==="
(iptables -L -n 2>/dev/null | grep -E '3000|DROP|REJECT' || echo "iptables not readable") 
(nft list ruleset 2>/dev/null | grep -i 3000 || true)

echo ""
echo "=== [6] Flag world-readable Metabase config/db files containing secrets ==="
find /opt /srv /usr/local -name 'metabase.db*' -o -name '.metabase*' 2>/dev/null | while read -r f; do
  perms=$(stat -c '%a' "$f" 2>/dev/null || echo "?")
  [ "$perms" != "?" ] && [ "$perms" -gt 640 ] && echo "WARNING: $f has permissive mode $perms - restrict to 640 and service account ownership."
done

echo ""
echo "=== [7] Check environment for embedded DB credentials ==="
ps aux | grep -i '[m]etabase' | grep -oE 'MB_DB_(CONNECTION_URI|PASSWORD)=[^ ]+' | sed 's/=.*/=<REDACTED - PRESENT>/' || echo "No credentials exposed in process args."

echo ""
echo "Audit complete. Remediate any exposure findings BEFORE the next change window."

Remediation

Immediate Actions (24–48 Hours)

1. Inventory and verify exposure. Identify every Metabase (and other BI) instance in your estate — including shadow deployments stood up by data teams. Confirm none are internet-reachable. Check load balancers, cloud security groups, NACLs, and reverse-proxy configs. Run an external scan against your own ASN ranges; do not trust internal documentation.
2. Patch to the current Metabase release. The Metabase ecosystem has a history of critical pre-auth vulnerabilities; anything more than one minor release behind should be treated as an emergency change. Verify the running JAR/container digest matches a current, signed release. See the official release and security guidance at https://www.metabase.com/docs/latest/installation-and-operation/upgrading-metabase and https://github.com/metabase/metabase/security/advisories.
3. Rotate all secrets the platform holds. Metabase stores database connection credentials, and potentially SMTP, LDAP, and cloud storage keys. If compromise is suspected, rotate every credential the service account uses — and critically, review whether the database role Metabase uses is over-privileged. It should be read-only against only the schemas it needs, never a superuser.
4. Enforce SSO + MFA. Metabase must sit behind your IdP (SAML/OIDC) with MFA enforced. Local Metabase accounts should be disabled or reserved for break-glass with vaulted credentials.

Structural Controls (30–60 Days)

5. Network segmentation. BI platforms belong on a restricted management/analytics segment reachable only from analyst subnets or via ZTNA. The reporting tier should never be a pivot point into production databases from general user networks.
6. Least-privilege data architecture. Replace direct production DB connections with read replicas containing minimized data sets. If your reporting tool only needs enrollment counts, it should not be able to SELECT student PII. This single control would have materially reduced the blast radius here.
7. Egress and export monitoring. Alert on bulk export API usage (the Sigma and KQL content above) and on unusual egress volume from BI hosts. Metabase servers have predictable traffic profiles — deviations are detectable.
8. Data minimization for regulatory scope. For EdTech and any holder of minors' data: audit what PII actually needs to persist, set retention limits, and document your notification obligations (state breach laws, FERPA coordination with school districts, GDPR where applicable). The 1M+ affected individuals here include parents and staff — notification logistics alone will be substantial.

For Organizations Affected by the Mathspace Breach

If your school district or organization is a Mathspace customer: engage their notification process directly, determine exactly which data elements were exposed for your users, assess whether directory credentials or integration tokens shared with the platform need rotation, and prepare parent/staff communications. Do not wait for the vendor to define your response.

Closing Assessment

This breach is a case study in a pattern I have seen repeatedly across IR engagements: the perimeter held, the production database was never directly touched, and the attacker walked in through the analytics layer that everyone forgot was a privileged data pathway. BI platforms are databases with a web login page — classify them accordingly in your asset inventory, your vulnerability management SLAs, and your detection coverage. If you cannot answer "where is our Metabase, who can reach it, and what can it read" within one hour, that is your gap to close this week.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub