In short: On August 3, 2026, attackers exploited a critical zero-day SQL injection in the Metabase analytics platform and accessed the entire Framework customer database. The breach exposed names, email addresses, phone numbers, physical addresses, and login IP addresses for all customers. Payment details and order history were not compromised.
What happened
Framework, the San Francisco company behind repairable and upgradeable laptops, disclosed that on August 3, 2026, an unknown attacker exploited a zero-day vulnerability in the company's cloud Metabase instance — a business intelligence tool used for internal analytics. Metabase detected active exploitation and notified Framework on August 6. The laptop maker confirmed the breach the same day and began emailing all affected customers.
Framework was not the only victim. At least two other companies — Tally and Kilo Code — were hit in what appears to be a coordinated campaign targeting organisations running vulnerable versions of Metabase. All three incidents trace back to the same critical flaw in Metabase 1.58+. Our security blog covers how attacks on a shared platform can cascade into breaches at dozens of customer organisations simultaneously.
What data was exposed
According to the Framework breach notification, the attacker accessed:
- Customer full names;
- Email addresses;
- Phone numbers;
- Login IP addresses;
- Shipping and billing addresses (country, city, region, ZIP code);
- For business accounts: company names, VAT/EIN numbers, and billing contact details.
What was not exposed: order history and payment card data were not compromised. This rules out direct financial fraud from this breach alone — but does not eliminate targeted phishing using the stolen personal profile data.
How the Metabase vulnerability worked
The flaw was a SQL injection in Metabase's publicly reachable password-reset endpoint, with a CVSS score of 10.0 — the maximum possible. No authentication was required: an attacker with network access to the URL could inject arbitrary SQL into Metabase's application database, escalate to administrator, modify configuration, and exfiltrate credentials for any connected data source. That is exactly how Framework's customer tables were stolen.
The vulnerability affected Metabase versions 1.58 and above and was already being actively exploited when Metabase first discovered it — a textbook zero-day scenario. Even the most security-conscious Metabase customer had no patch available at the time of the attack.
What this means for affected customers
A contact data breach is not just an inconvenience. The combination of name + email + phone number + physical address creates a rich profile that is ideal for targeted phishing. A fraudster can send a convincingly personalised email or call pretending to be Framework support, a courier company, or a bank — and the message will be credible because they already know your real name and home address.
The leaked login IP addresses deserve particular attention. An IP address reveals approximate geolocation and your internet service provider. If you logged into Framework from your home or office network, the attacker now has another piece of your digital fingerprint. This is exactly why using a VPN for online services reduces exposure: only the VPN server's IP appears in a service's logs, not your real address.
How to protect yourself
If you are a Framework customer, take these steps:
- Check for the Framework notification email. The company promised to notify all affected customers. If you have not received it, check your spam folder. The official communication comes from Framework's domain.
- Enable two-factor authentication (2FA) on your Framework account and on any other service using the same email. Even if an attacker obtains your password from another breach, 2FA blocks the login.
- Watch for targeted phishing. In the coming weeks, scam emails and calls using data from this breach are significantly more likely. Do not click links in emails claiming to be from Framework — type the URL manually instead.
- Change your password on Framework and on any other site where you reuse the same credential.
- Mask your IP address going forward. LiMP VPN replaces your real IP with a VPN server address on every connection. It cannot undo the current breach — but it prevents your home IP from appearing in future logs and reduces your exposure in subsequent incidents.
Sources
- TechCrunch — Computer maker Framework notifies all customers of a data breach
- BleepingComputer — Framework, Tally disclose Metabase data-theft attacks
- SecurityLab — Framework: customer data leaked via Metabase zero-day
- Help Net Security — Metabase zero-day exploited to access Framework customer data