Computer maker Framework notifies 'all customers' of a data breach

Framework, a company that makes modular repairable computers, said it has notified all of its customers that hackers stole their names, email addresses, phone numbers, and physical addresses, due to an incident at a company that provides business intelligence. On Thursday, several Framework customers said on social media that they had received an email from the company notifying them of the data breach.

Framework spokesperson Eric Schumacher told TechCrunch the breach affected “all customers,” but declined to specify a number. Framework computers are a relatively niche product, but some estimates say the company has sold hundreds of thousands of devices.

According to the notification seen by TechCrunch, the company blamed the data breach on an upstream cyberattack at Metabase. Metabase disclosed its own breach in a blog post on its website, saying it was hacked by someone using an unknown security flaw — a so-called zero-day. The company said the hackers exploited the bug to gain the ability to access customers’ databases stored on Metabase’s cloud servers.

In its email to customers, Framework also included the email Metabase sent to the company, which said hackers accessed Framework’s cloud instance. Framework said it investigated the incident and found that hackers had stolen its customers’ personal data, but did not include their payment information. Metabase did not respond to a request for comment.

Why it matters

The breach is another reminder that a company’s security is only as strong as the weakest vendor in its stack — Framework’s own systems weren’t compromised, but its customers’ data leaked anyway through a business-intelligence tool it relied on.