Mathspace

Mathspace's internal reporting system was reached through a known vulnerability in a self-hosted install, left unpatched from August 10 to August 27. The company puts the toll at 1,079,819 people: names, usernames, emails, login and activity metadata, though it says academic records, credentials, and school links stayed clear. A patch that exists and simply wasn't applied is not an attack; it is a maintenance doorway with a sign that tells the bad guys, "come on in, take what you want".