Framework, the company that sells repairable modular laptops to people who actually want screwdrivers near their computers, spent August 6 and 7 telling customers their personal information had been stolen. The path in was not a Framework storefront bug. It was Metabase, the business-intelligence tool Framework used in the cloud. TechCrunch and Engadget both saw the customer email: names, email addresses, phone numbers, shipping and billing addresses, and login IP addresses were accessed. Order and payment information were not in the stolen set, Framework said. Metabase has described the underlying issue as an unknown zero-day against Metabase Cloud, now identified and patched.
What Framework says left the building
A spokesperson told TechCrunch the breach affected "all customers" and declined to give a headcount. Framework is still a niche manufacturer relative to Dell or Apple, but public estimates put lifetime device sales in the hundreds of thousands, which is plenty of humans to email. The notification many customers posted publicly matches what reporters quoted: contact and address data plus login IPs, not card numbers sitting in a payments vault.
Card data staying safe lowers one kind of harm and leaves another wide open. Names, emails, phones, and physical addresses are how phishing kits get their costumes right. Login IPs help an attacker guess where you usually authenticate from. Nobody should shrug because CVV fields were spared.
Framework said it rotated credentials after Metabase's notice, confirmed no unexpected admin access outside Metabase, and is reviewing how much data it parks in external analytics vendors. That last sentence is the adult admission: BI tools are production systems that hold customer tables, even when marketing calls them dashboards.
Skipping card data lowers the odds of classic payment fraud and does nothing for the inbox attacks that follow address-book leaks. Expect Framework-themed parcel scams, shipping-address confirmation lures, and fake RMA portals. Customers who reuse emails across GitHub and shopping accounts should watch those identities too.
Framework's brand community is unusually loud on social media for a PC maker, which is how journalists spotted the emails so fast. That same loudness means bad guidance spreads beside good guidance. Stick to Framework's notice and Metabase's advisory over random Discord pastebins.
Anyone who bought a Framework laptop as a privacy-minded alternative to big OEMs now has a reminder that modular hardware does not modularize your SaaS risk. The chassis can be repaired with a screwdriver. The analytics tenant cannot.
Metabase's zero-day, in plain language
Metabase's own security update says attackers hit Metabase Cloud using an unknown vulnerability in versions 1.58 and above. The company blocked the endpoints used in the attack, identified the bug, patched it, notified law enforcement, and brought in a third-party forensics firm. Cloud customers, Metabase says, are already upgraded. Self-hosted operators were told to move to the latest point release of whatever major line they run, or temporarily block the password-reset API path while they do.
Public advisories describe a critical issue, some secondary coverage floated a CVSS 10 framing before a CVE ID settled, centered on session/password-reset style API abuse that could lead to account takeover inside a Metabase instance and from there into connected databases. I am not reproducing request recipes. If you run Metabase, read Metabase's post and your logs for the patterns they publish. If you only consume someone else's SaaS that happens to use Metabase, you are in Framework's seat: waiting on a vendor email.
Metabase told Framework its instance was vulnerable and that the attacker reached the connected data. Framework's investigation of the logs Metabase provided agreed. That chain, SaaS BI vendor to customer warehouse to end-user PII, is how a lot of 2026 breaches will keep looking. The laptop maker is the brand customers recognize. The analytics host is where the hole was.
Self-hosted Metabase operators got the sterner to-do list: upgrade point releases, inspect logs for the reset-password then user/current pattern Metabase published, rotate DB credentials, hunt unknown admins. Cloud customers were patched by the vendor, which is comforting until you remember patching the hole does not rewind exfiltration that already happened.
A CVSS score without a CVE yet is awkward for enterprise trackers that key off MITRE IDs. Track the vendor advisory URL anyway. Waiting for a CVE number before rotating credentials is how IR theater replaces IR.
Metabase's preliminary note that forensics are ongoing should keep legal teams from overclaiming closure. Patched and fully scoped are different milestones. Framework's customer letter was right to stay concrete about fields accessed and humble about everything still under investigation.
The third-party trust hangover
Framework built a reputation on ownership and repairability. Losing customer addresses through a dashboard vendor is an awkward brand collision. It is also boringly common. Startups wire Metabase, Looker, or a hastily shared BigQuery to a replica and move on. Security reviews obsess over the storefront and the SSO app, then treat BI as internal furniture.
Engadget noted Framework's email went out late on August 6 after Metabase's August 3 discovery timeline. A multi-day gap between vendor detection and customer notice is not unusual once lawyers and forensics get a vote. It still feels long when your home address is in the dump. Framework said it is notifying regulators where relevant even when local rules might not strictly require notice for this data class. That is the right instinct.
For other Metabase Cloud customers, the actionable question is whether your instance appears in the vendor's incident outreach and whether every database credential hanging off that instance has been rotated. For Framework buyers, watch for spear-phishing that name-drops order history you never shared in the breach email, attackers blend leaked PII with guesses. And maybe ask your own vendors a rude question this month: which analytics tools can SELECT * from our customers, and who patches those tools when a zero-day shows up on a Monday?
The lesson for hardware startups is unglamorous: your BI SaaS is in scope for customer PII reviews. Contractual security exhibits should ask whether analytics tenants are isolated, how quickly zero-days are patched, and whether the vendor will fund customer forensics when their bug leaks your table. Most Series B shops never ask. Framework just became the case study that makes the question less theoretical.
Payment data staying out is good news and not a gold star. Contact databases are enough to hurt people. Framework told customers anyway, even where statutes might have allowed silence. Other companies will now be measured against that choice.
If you are a Framework customer reading this after the email, the practical moves are dull: distrust unexpected shipping emails, freeze credit if your jurisdiction makes that easy and you are anxious, and do not reuse the password you never should have reused anyway. The breach did not publish passwords, Framework said, habits still matter when attackers know where you live.
- Privacy
