Framework Confirms Extensive Data Breach, Customer Information Compromised

In a significant cybersecurity incident, Framework, the innovative company renowned for its modular and repairable computers, has confirmed a widespread data breach impacting all of its customers. The breach, attributed to an upstream cyberattack on one of its business intelligence providers, Metabase, has resulted in the theft of sensitive personal information.

The Breach Unfolds: What Happened?

Framework began notifying its entire customer base on Thursday, August 7, 2026, via email, confirming that hackers had successfully exfiltrated names, email addresses, phone numbers, and physical addresses. While the exact number of affected individuals remains undisclosed, a spokesperson for Framework, Eric Schumacher, confirmed to TechCrunch that the incident touched “all customers.” Given that Framework, despite its niche market, is estimated to have sold hundreds of thousands of devices, the scale of this compromise is considerable.

Root Cause: A Zero-Day Vulnerability at Metabase

The investigation by Framework points to a cyberattack on Metabase, a third-party business intelligence provider. Metabase itself had previously disclosed a breach on its official blog, revealing that an unknown security flaw—a ‘zero-day’ vulnerability—was exploited by attackers. This critical flaw allowed the hackers to gain unauthorized access to customer databases stored on Metabase’s cloud servers.

Framework’s communication to its customers included an excerpt from Metabase’s own notification, which explicitly stated that hackers had accessed Framework’s specific cloud instance. Following its own thorough investigation, Framework confirmed the theft of customer personal data. Crucially, the company has assured customers that payment information was not compromised in this incident.

Implications for Framework Customers

While payment details appear safe, the stolen personal data—names, addresses, emails, and phone numbers—could potentially be used for phishing attempts, identity theft, or targeted scams. Framework customers are advised to remain vigilant against suspicious communications and to be wary of unsolicited requests for personal or financial information.

This incident underscores the complex and interconnected nature of modern cybersecurity risks, where a vulnerability in one vendor’s system can have far-reaching consequences for their clients and their customers.

For more details, visit our website.

Source: Link