More than a million students, parents and teachers across Australia and New Zealand have had personal data exposed in a breach that education technology company Mathspace disclosed this week. But the detail that should worry brokers isn't the breach itself, it's the 23 days between the warning and the fix.
Mathspace notified regulators in both countries on September 4, a day after confirming the intrusion. The company runs its own installation of Metabase, a business analytics tool used for internal reporting. On August 6, Metabase issued a critical advisory for a vulnerability rated the maximum 10 out of 10 for severity, warning that an attacker could remotely gain administrator access without valid credentials. The flaw was serious enough that the US Cybersecurity and Infrastructure Security Agency added it to its register of vulnerabilities known to be under active exploitation.
Mathspace's internal alert-triage process failed to flag the advisory for action. An intruder got in four days after the advisory was published, and by August 27 had downloaded data on more than 1.08 million people, including names, email addresses, usernames, time zones and login records, though not passwords or financial details. The software wasn't patched until August 29, after a second Metabase notice caught someone's attention, and even then, the additional checks recommended to confirm whether affected systems had been compromised were reportedly not completed.
Read next: Perth arrests reveal the supply chain blind spot in Australian cyber cover
Twenty-three days between advisory and patch is what turns this from a routine breach story into a live test of cyber underwriting conditions. Coalition's chief underwriting officer, Tiago Henriques, has said publicly that at least one well-known insurer excludes losses tied to a vulnerability scoring above 8 out of 10 where a patch has been available for three weeks or more and wasn't applied. The comment describes market practice rather than a named, sighted clause, so brokers should confirm the specifics against the relevant PDS before relying on it. Mathspace's vulnerability scored the maximum 10, and its patch sat unapplied for more than three weeks while data was being taken.
Henriques argues the exclusion casts too wide a net: as of July 2025, Coalition calculated that 61,764 known vulnerabilities would technically qualify for such an exclusion, yet only 1.1% of those had been confirmed as actively exploited - the basis for his view that blanket CVE exclusions risk "putting businesses in an impossible situation." Mathspace's vulnerability scored the maximum 10, and its patch sat unapplied for more than three weeks while data was being taken.
Not every insurer takes the same approach. Chubb's Neglected Software Exploit Endorsement, available in the Asia-Pacific market, instead gives policyholders a 45-day grace period to patch a published CVE before risk-sharing begins shifting to the policyholder at the 45-, 90-, 180- and 365-day marks - a sliding scale rather than a hard cut-off, and one Chubb applies specifically where it assesses a policyholder's patch-management hygiene as weak.
It reflects a broader shift: major Australian underwriters increasingly use external scanning and third-party telemetry to check a client's actual patch cadence against what's been declared at underwriting, rather than relying on attestation alone. A mismatch is now as likely to surface at renewal as at claim time.
The Australian Signals Directorate's Essential Eight framework recommends patching internet-facing systems within 48 hours of a critical vulnerability being identified. Government's own compliance with a comparable benchmark is mixed: the ASD's Commonwealth Cyber Security Posture report found 22% of federal entities reached Essential Eight Maturity Level 2 across all eight strategies in 2025, up from 15% in 2024 but still below 2023's 25% (Australian Signals Directorate, The Commonwealth Cyber Security Posture in 2025, February 2026).
Vicky Sheridan, senior cyber claims specialist at AXA XL in Australia, points to a wider trend of breaches originating with a technology vendor rather than the insured business itself, citing last year's compromise of the Canvas learning platform, which disrupted more than 9,000 institutions worldwide. Such incidents, she says, show how a single vendor failure can produce "material operational, financial, and reputational impacts" for organisations with no direct control over the flaw.
Kieran Doyle, who heads the cyber, data and technology practice at law firm Wotton Kearney, reports a recent rise in claims activity running above the yearly average - an increase he attributes partly to ransomware and partly to privacy breaches of exactly this kind, incidents he believes were always occurring but had gone largely undetected until recently. Both comments were made in the context of Insurance Business Australia's 2026 5-Star Cyber Report.
Read next: ADS cyberattack tests whether supply chain policies actually respond
Education recorded 81 notifications to the Office of the Australian Information Commissioner in 2025, tying for fifth among all sectors by volume . It's part of a recognisable pattern of edtech incidents: PowerSchool's December 2024 breach reportedly affected around 62 million students and educators, a figure worth confirming against PowerSchool's own disclosures before it's used in client-facing material. Separately, and distinct from that breach, PowerSchool and Chicago Public Schools agreed in February 2026 to a US$17.25 million settlement over a class action alleging students' private communications on its Naviance platform were shared with third-party analytics tools without consent; the deal received preliminary court approval, with a final approval hearing held in August 2026 . In the US, the FTC separately finalised a ten-year consent order against another edtech provider, Illuminate Education, on June 5, 2026, over a 2021 breach that exposed the data of more than 10 million students.
Read next: AI cyberattacks outpace Australian firms' defences
The Mathspace breach sits across three separate notification regimes. Federally, the Notifiable Data Breaches scheme received 1,205 notifications in 2025, an 8% rise on 2024's 1,112, and the highest total since the scheme began in 2018 (OAIC, 2026). Australian Privacy Commissioner Carly Kind has described data breach risk to Australian organisations as "substantial and rising year on year." Queensland's public sector - which includes its Department of Education - operates under a separate mandatory notification scheme introduced in 2023, giving agencies 30 days to assess a suspected breach. Across the Tasman, New Zealand's Privacy Commissioner expects notification within 72 hours of an organisation realising it has a reportable breach, with financial penalties for non-compliance.
For brokers with clients dependent on third-party platforms, particularly in education, the incident offers a ready-made set of questions: do vendors further down the supply chain have patch-management processes capable of acting on a maximum-severity advisory within 48 hours? Does existing cyber cover account for breach costs spanning both Australian and New Zealand regulatory regimes simultaneously? And does the policy wording tie coverage to a patching benchmark the client may not, in practice, be meeting?
That last question is increasingly being answered in the fine print rather than at the negotiating table - which is exactly why it's worth asking before a claim, not after one.
Read next: The scam liability framework brokers cannot afford to ignore
