Framework says customer data was accessed in breach of database provider
Laptop maker Framework has told customers that hackers accessed customer information through a breach of its database vendor Metabase, though payment details were not exposed.
Framework, known for making repairable and upgradeable laptops, emailed all of its customers late Thursday, August 6, disclosing that a data breach had exposed some of their personal information. The company said attackers gained access to customer names, login IPs, addresses, phone numbers and email addresses through a hack of Metabase, the outside provider that manages Framework's business database. Payment information was not part of the exposed data.
Framework's email included an explanation from Metabase, which said it identified the attack on August 3. According to a post on Metabase's own website, the intruder exploited a previously unknown "0-day" vulnerability, which the company has since found and patched. Metabase cautioned that its findings and security recommendations remain preliminary while it works with a third-party forensic investigation firm to determine the full scope of the incident.
Framework's response
After being notified, Framework rotated its credentials and said it confirmed there were no changes to admin access or to any systems outside of Metabase. The company also said it is reviewing and improving how it handles data storage with external database vendors.
The breach lands at a difficult time for Framework. The company has been hit hard by an ongoing memory shortage this year, raising prices in January and again in March. It also had to ship less RAM than advertised in some preorders for its new Framework Laptop Pro because of rising component costs, offering full refunds to customers unwilling to accept the change.
