Framework loses customer data in Metabase zero-day attack

Framework, a modular laptop manufacturer, has announced that its customers' personal information has been compromised due to a zero-day attack on analytics provider Metabase. The breach exposed names, email addresses, phone numbers, physical addresses, and login IP addresses, as well as possibly company names, phone numbers, VAT or Employer Identification Numbers (EINs), and billing email addresses for business customers. Framework assured customers that order and payment details remained secure.

Metabase, which Framework uses for data analysis, disclosed that the attack targeted its cloud service with a previously unknown vulnerability in versions 1.58 and later. Framework acted swiftly, rotating credentials for all databases connected to its Metabase instance and notifying regulators where required. However, the breach did not extend to personal details crossing most reporting thresholds in many regions.

Metabase reported the attack on August 3, alerting Framework at 9am Pacific Time on August 6. After the incident, Framework immediately rotated credentials for all databases connected to its Metabase instance and initiated an investigation with a third-party forensics firm. The intrusion allowed the attacker to potentially inject arbitrary SQL against the application's database, gain administrator access, alter configuration settings, steal credentials, query data, and export results.

Framework has yet to announce any changes resulting from the review of customer information made available through external analytics services. The incident occurred in a challenging period for Framework, which recently raised memory prices due to a significant increase in the cost of LPCAMM2 memory and warned about rising CPU prices that could push overall system prices higher in the coming weeks.