Framework Notifies All Customers After Data Breach Exposes Personal Information

Framework, the company known for making modular and repairable computers, has notified all of its customers that hackers accessed their personal information through a breach at business intelligence company Metabase.

The stolen information includes customers’ names, email addresses, phone numbers and physical addresses. Framework confirmed that the incident affected “all customers,” although the company did not disclose the exact number of people involved.

Several Framework customers reported receiving breach notifications from the company on Thursday. Framework spokesperson Eric Schumacher confirmed the incident and said the company had contacted affected customers.

Hackers exploited Metabase vulnerability

Framework attributed the breach to an upstream cyberattack involving Metabase, which provides business intelligence and data analytics services.

Metabase disclosed the incident in a blog post, saying attackers exploited an unknown security vulnerability, commonly known as a zero-day. The flaw allowed the attackers to access customer databases stored on Metabase’s cloud infrastructure.

Framework included Metabase’s notification in its own message to customers. According to the notice, hackers accessed Framework’s cloud instance as part of the attack.

Framework said it investigated the incident after learning about the breach and determined that customers’ personal information had been accessed and stolen. The company said payment information was not included in the compromised data.

While Framework’s computers remain a relatively niche product, the company has sold hundreds of thousands of devices according to some estimates. The incident therefore potentially affects a substantial customer base, even though Framework has not provided a specific figure for the number of individuals whose information was exposed.