Framework Discloses Data Breach Affecting All Customer Records After Third-Party Hack

What Framework Told Its Customers About the Breach

Framework, the company known for its modular, repairable laptops, has confirmed that a data breach at its business intelligence provider exposed the personal information of its entire customer base. According to a notification sent to users, hacked records included full names, email addresses, phone numbers and physical addresses. The company said no payment card data was accessed during the incident.

The breach originated at Metabase, an open-source analytics platform that Framework used to manage customer data. Metabase disclosed in a blog post that an unknown attacker had exploited a zero-day vulnerability in its cloud service, gaining the ability to access customer databases stored on its servers. Framework’s own investigation, conducted after Metabase informed it of the compromise, confirmed that hackers had exfiltrated the listed personal data fields from its cloud instance.

A Framework spokesperson told TechCrunch that the incident affected “all customers,” though the company did not disclose an exact figure. Industry estimates place Framework’s cumulative sales in the hundreds of thousands, a small but fiercely loyal community built around repairable hardware and transparency. The breach’s full scope may not be known until other Metabase clients disclose similar compromises.

The Third-Party Risk That Exposed Framework's Entire Customer Base

The Framework breach illustrates how a single weak link in the software supply chain can expose sensitive data across an entire customer base. What makes this incident particularly instructive for corporate IT and privacy professionals is the nature of the third-party tool at its core.

Where Framework’s Supply Chain Failed

Framework relied on Metabase’s cloud-hosted analytics to run business intelligence on customer records. By outsourcing that capability, the hardware maker handed control of its customer data to a third-party vendor whose security posture it could not fully control. The fact that an attacker exploited a previously unknown vulnerability to breach Metabase’s infrastructure means that even diligent vetting may not have flagged the risk. The breach was not a matter of a misconfigured database or weak employee credentials—it was an advanced, zero-day attack on the vendor’s own platform.

The Metabase Zero-Day and Broader Implications

Metabase’s acknowledgment that a zero-day flaw was used suggests this was a targeted intrusion rather than an opportunistic scan. While Framework is the most prominent name to publicly link a customer data breach to the event, the analytics platform serves thousands of organisations. Other clients may yet be impacted, potentially making this a multi-company data exposure event. For business users, the incident reinforces the urgency of mapping third-party software that touches personal data and requiring contractual guarantees—and incident response protocols—for vendors with elevated access.

Regulatory and Reputation Fallout

Although payment details were not stolen, the combination of name, email, phone number and physical address is more than enough to enable convincing phishing and social engineering campaigns. For Framework, a brand whose identity is built on community trust and transparency, how it communicates and remediates the breach will be closely watched. Depending on the geographic makeup of its customer base, the company may face notification obligations under the GDPR (European customers), CCPA (California residents), or emerging US state privacy laws. Fines are unlikely to be material to a company of Framework’s size, but regulatory scrutiny and potential lawsuits from affected users could create significant distraction.

Immediate Steps for Framework Owners

Framework owners should take the following concrete steps to reduce the risk of secondary attacks:

• Assume incoming phishing attempts will use your purchase history. Because the exposed data links your name to a specific product, attackers can craft highly convincing emails or texts that reference your exact model, order date, or accessories. Treat any unsolicited communication asking for passwords, payment details, or remote access as hostile—even if it appears to come from Framework’s own support addresses.
• Consider a temporary credit freeze if your physical address was exposed. No financial account numbers were stolen, but an exact residential address plus phone number can be enough to attempt identity-based fraud. Placing a no-cost freeze with major credit bureaus adds a layer of protection without impacting your daily finances.
• Rely only on official Framework channels for updates. The company has a dedicated support site and an active community forum. Bookmark framework.io and ignore links in unsolicited messages claiming to offer breach assistance or credit monitoring—these are a common fraud vector after large PII breaches.
• Strengthen your Framework.com account if you have one. While passwords were reportedly not included in the exposed fields, changing your password and enabling any available two-factor authentication reduces the risk of an account takeover if password hashes were incidentally obtained.