The company says payment details weren’t exposed.
Daniel Cooper for Engadget
Framework, maker of deliberately repairable and upgradeable computers, has notified all of its customers that their data was exposed in a breach. According to an email the company sent late Thursday, August 6, customer names, login IPs, addresses, phone numbers and emails were accessed during a hack of the company’s business database provider Metabase. Payment information was not included in the breach.
The company included Metabase’s explanation in its own email, which details when the provider identified the attack on August 3 and the actions Metabase took to address it. According to a blog on Metabase’s own website, someone used an “unknown (0-day) vulnerability” to access data, which Metabase has now identified and patched. The provider’s findings and security recommendations are “preliminary” as of now. “We are working with a third-party forensic investigation firm to understand the full nature and scope of the event,” Metabase shared in an email to Framework.
Ian Carlos Campbell for Engadget
Framework, for its part, says it rotated its credentials after it was notified of the breach and “confirmed that there were no changes in admin access or access to systems outside of Metabase.” The company says it’s also “reviewing and improving [its] methodology for data storage in external database vendors.”
A data breach couldn’t have come at a worse time for Framework. Despite announcing an exciting lineup of new products earlier this year, the company has struggled with the ongoing memory shortage more than most. Framework first announced it was raising prices in January, and then raised them again in March. Not long after collecting preorders for the new Framework Laptop Pro, the company was also forced to include less RAM than advertised in some preorders to account for the growing cost of components and extend a full refund to customers who weren’t willing to pay.