Modular computer maker Framework has notified every customer in its database that their personal information was compromised in a supply-chain breach originating at Metabase, the business intelligence provider that hosted Framework's cloud instance. The notification, sent on August 6, 2026, confirms that hackers exploited a previously unknown zero-day vulnerability in Metabase Cloud to access customer names, email addresses, phone numbers, physical addresses, and login IP addresses. Payment data was not exposed, Framework said.

Framework spokesperson Eric Schumacher said the breach affected "all customers" but declined to provide a specific headcount. Industry estimates place Framework's total device sales in the hundreds of thousands, suggesting a similarly sized pool of affected individuals. The incident compounds a difficult period for the company, which has already navigated two price increases this year driven by memory shortages and a controversial RAM reduction on some Laptop 13 Pro preorders.

Metabase disclosed the intrusion on its official blog on August 6, stating that an attacker used an unknown security flaw — a so-called zero-day — in versions 1.58 and above to reach customer databases stored on Metabase's cloud servers. The company said it immediately blocked the exploited endpoints, identified and patched the vulnerability, and began a forensic review with a third-party firm. Metabase characterized its findings and security recommendations as preliminary.

What's New / Specs

  • Breach origin: Metabase Cloud, Framework's business intelligence provider, compromised on August 3, 2026.
  • Attack vector: Zero-day vulnerability in Metabase versions 1.58 and above (CVE not yet assigned in public disclosures). Attackers exploited the /api/session/reset_password endpoint to inject arbitrary SQL, gain administrator access, and exfiltrate application database contents.
  • Data accessed: Customer names, email addresses, phone numbers, physical addresses, and login IP addresses. Payment information, including credit card details, was not stored in the affected Metabase instance and remains secure.
  • Scope: Framework states "all customers" were affected; no exact figure disclosed. Metabase's investigation is described as preliminary, with a third-party forensic firm engaged to determine full scope.
  • Remediation steps taken: Framework rotated all credentials after notification, confirmed no changes to administrator access or systems outside Metabase, and is reviewing its methodology for data storage with external database vendors.
  • Metabase patches: Metabase released minimum safe point releases for each affected version line (0.58.24 through 0.63.5) on August 6. Cloud instances were auto-patched; self-hosted administrators must upgrade manually or block the vulnerable endpoint as a temporary workaround.

The Metabase security advisory details a specific attack pattern: a POST to /api/session/reset_password returning a 400 status code, followed by a GET to /api/user/current returning 200. Administrators seeing this sequence in logs should treat their instance as compromised and follow the recommended steps, including revoking all active sessions, rotating database credentials, and auditing administrator accounts and query history. Metabase also advised reviewing data warehouse logs and Metabase activity for any sign of unauthorized access.

Framework's notification email included the full text of Metabase's disclosure to Framework, which stated that Metabase identified the attack on August 3, blocked the exploited endpoints, and patched the vulnerability. Metabase characterized its findings and security recommendations as preliminary as of the notification date.

Why It Matters

This breach illustrates the cascading risk of supply-chain dependencies for hardware companies that rely on third-party SaaS platforms for business operations. Framework's core product — modular, repairable laptops — is unaffected technically, but the customer relationship data that supports orders, support, and community engagement has been exposed. For a brand that differentiates on transparency and user trust, the incident arrives at a particularly sensitive moment.

Framework has faced component-cost headwinds throughout 2026. The company raised prices in January and again in March as DRAM spot prices surged. Shortly after opening preorders for the higher-end Laptop 13 Pro, Framework informed some buyers that their configurations would ship with less RAM than originally specified, offering full refunds to dissatisfied customers. That episode tested community goodwill; the data breach risks deepening skepticism just as Framework attempts to stabilize its supply chain and pricing.

From a threat-model perspective, the exposed dataset — names, addresses, phones, emails, and login IPs — enables targeted phishing, identity theft, and credential-stuffing attacks. Attackers can correlate login IPs with geographic data to craft convincing social-engineering lures. While payment data was not compromised, the personal identifiers are sufficient for account takeover attempts on other services where customers reuse passwords. Framework has not offered credit-monitoring services as of the notification date.

The Metabase zero-day also highlights a broader operational risk: business intelligence tools often hold aggregated customer data from multiple internal systems, making them high-value targets. Metabase's advisory notes that once an attacker gains admin access via the SQL injection, they can "change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data." Organizations using Metabase Cloud were auto-patched, but self-hosted instances remain vulnerable until upgraded.

Our Take

Framework's decision to notify all customers promptly and publish Metabase's disclosure verbatim is the right posture. The company avoided the common trap of minimizing scope or delaying notification while forensic work continues. That transparency aligns with Framework's brand promise and may preserve trust better than a narrower, later admission would have.

However, the breach exposes a gap in Framework's vendor risk management. Storing customer PII in a business intelligence platform — especially one accessible via a public cloud endpoint — creates a single point of failure that product-focused startups often overlook. Framework's statement that it is "reviewing and improving" its external data storage methodology is necessary but reactive; the review should have occurred before onboarding a BI tool with broad database access.

For customers, the immediate priority is vigilance against phishing and credential reuse. Framework has not yet committed to subsidizing credit freezes or identity-monitoring services, a step that would demonstrate material responsibility beyond transparency. Given the company's current margin pressure from component costs, that decision may face scrutiny.

The Metabase zero-day itself is a reminder that widely deployed open-source analytics platforms can become high-profile targets. Metabase's rapid patching of Cloud instances and detailed self-hosted guidance set a good example for vulnerability disclosure, but the window between exploitation (August 3) and public advisory (August 6) gave attackers a multi-day advantage. Organizations running self-hosted Metabase should treat the upgrade as urgent.

FAQ

What specific data was stolen in the Framework breach?

Hackers accessed customer names, email addresses, phone numbers, physical addresses, and login IP addresses. Payment information such as credit card numbers was not stored in the compromised Metabase instance and was not exposed.

How did the attackers gain access to Framework's data?

The attackers exploited a zero-day vulnerability in Metabase Cloud (versions 1.58 and above) via the /api/session/reset_password endpoint. This allowed SQL injection, administrator privilege escalation, and exfiltration of the application database containing Framework's customer records.

Has Framework disclosed how many customers are affected?

Framework's spokesperson confirmed that "all customers" were affected but declined to provide a specific number. Industry estimates suggest Framework has sold hundreds of thousands of devices, implying a similarly large pool of impacted individuals.

What should Framework customers do now?

Customers should watch for targeted phishing attempts using their exposed personal details, enable two-factor authentication on any accounts sharing passwords with their Framework account, consider placing credit freezes with major bureaus, and monitor for unauthorized login attempts. Framework has not yet offered credit-monitoring services.

Is Metabase safe to use after the patch?

Metabase Cloud instances were automatically upgraded to patched versions on August 6. Self-hosted administrators must upgrade to the minimum safe point release for their version line (e.g., 0.58.24, 0.63.5) or block the /api/session/reset_password endpoint as a temporary workaround. Metabase's investigation remains preliminary, and a third-party forensic firm is engaged.

Sources