Four days separated the fix from the break-in. Metabase shipped patched versions alongside a critical advisory on August 6 [5]. Mathspace's investigation puts the earliest unauthorized access at August 10, Australian Eastern Standard Time [7]. The advisory was never identified or escalated internally [6], and the instance stayed vulnerable until August 29, when a subsequent Metabase notice prompted the update [8]. That is 23 days after the fix existed [2] and 19 days after someone was already inside [3]. The export from the Australian reporting database ran on August 27 [9], two days before the patch went on [4].
Mathspace also says it did not complete the additional compromise checks recommended for potentially affected systems when it applied the update [10]. That omission is why August 29 produced no detection. The Metabase flaw handed out administrator access without a legitimate login [4], so installing the fixed version closes the route and says nothing about what came through it. The intrusion was confirmed on September 3 by a review of historical logs [11], five days after the patch [6] and 24 days after the first access [5].
What the reporting instance could reach shows up in the cleanup. On September 3 Mathspace took Metabase offline, revoked its API keys, disabled Metabase database-access accounts in both its Australian and US Snowflake environments, and changed the passwords on its Metabase Cloud SQL databases [12]. A self-hosted BI front end holds standing credentials into the warehouse because that is what it is for, which is the argument for patching it on the vendor's release schedule rather than the internal ticket queue.
The public record is thin where it counts. No CVE identifier, affected Metabase version, or statement about whether the instance was reachable from the open internet appears in the account of the incident [7]. Whether this was opportunistic scanning for a freshly disclosed pre-auth bug or a targeted operation is not established; Mathspace says the attacker's identity remains unknown [13]. Its finding that there is no evidence the data has been published, sold, distributed or misused [14] describes what Mathspace can see; it says nothing about what the attacker holds.
Mathspace is not requiring password resets, because no authentication credentials were in the export [18]. On the evidence, that holds. The one user-side action that changes an outcome is retiring any Mathspace password reused on another service [18].
