Framework Laptop Maker Discloses Major Data Breach Affecting All Customers Framework, the San Francisco-based modular laptop company known for its right-to-repair philosophy, has confirmed a data breach exposing the personal information of its entire customer base. The incident, disclosed this week via notifications to affected users, compromised names, email addresses, phone numbers, and physical shipping addresses effectively a full directory of every individual who has purchased one of the company’s devices. The breach strikes a particularly damaging blow to Framework, which has built its brand on transparency and user trust. While the company states that no payment or financial data was accessed since credit card details were not stored in the compromised system the exposed information remains highly valuable to cybercriminals. Such data is commonly exploited for phishing attacks, SIM swapping, and identity theft. Details about the breach remain limited. Framework has not specified when the unauthorized access occurred or how long attackers had access to customer data, leaving security experts questioning the company’s handling of the incident. The lack of clarity stands in contrast to Framework’s reputation for openness, further complicating its response. The timing of the breach adds to the fallout, as the company has positioned itself as a disruptor in the tech industry, challenging traditional manufacturers with its repairable, user-friendly designs. The incident underscores the risks even transparency-focused companies face in safeguarding customer data.

Framework Customer Data Exposed in Metabase Breach Framework, the manufacturer of repairable and upgradeable laptops, has disclosed a data breach affecting all its customers. In an email sent on August 6, the company revealed that customer names, login IP addresses, physical addresses, phone numbers, and email addresses were accessed during a cyberattack on Metabase, its business database provider. Payment information was not compromised. The breach occurred after an attacker exploited an unknown zero-day vulnerability in Metabase’s systems, which the provider detected on August 3. Metabase has since patched the flaw and is conducting a forensic investigation with a third-party firm to assess the full scope of the incident. The company’s findings remain preliminary. Framework confirmed it rotated credentials following the breach and found no evidence of unauthorized admin access or compromise beyond Metabase’s systems. The company is now reviewing its data storage practices with external vendors to prevent future incidents. The breach adds to Framework’s recent challenges, including supply chain disruptions and rising component costs. Earlier this year, the company raised prices twice due to memory shortages and was forced to reduce RAM in some preorders for its Framework Laptop Pro, offering full refunds to affected customers.

Critical Zero-Day Exploit in Metabase Grants Attackers Full Admin Access Metabase, a popular open-source business intelligence and data visualization platform, has confirmed active exploitation of a critical zero-day vulnerability (GHSA-vwf4-m7j8-wcjf) allowing unauthenticated attackers to gain full administrator control of affected instances. The flaw, rated with a maximum CVSS score of 10.0, impacts all versions from 0.58 through 0.63. The vulnerability is an unauthenticated SQL injection in the publicly accessible POST /api/session/reset_password endpoint. Attackers can inject arbitrary SQL commands into Metabase’s database, manipulate records, and escalate privileges to an admin account. From there, they can extract stored credentials, access connected databases, and exfiltrate sensitive data. Metabase first detected the exploit on August 3, when its own cloud platform was breached. The company patched the flaw within hours, automatically securing all Metabase Cloud customers. However, self-hosted deployments remain vulnerable until administrators apply the fix. At least two companies Framework and Tally have reported data breaches linked to this zero-day, with unauthorized access to customer information, including names, addresses, phone numbers, and emails. Security teams can detect exploitation by checking logs for a specific pattern: a POST /api/session/reset_password request returning a 400 status code, followed by a GET /api/user/current request returning 200. This sequence indicates successful session hijacking, and affected instances should be considered compromised. Metabase has released patched versions (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5) for self-hosted deployments. Organizations running older versions (pre-0.58) are unaffected. If the vulnerable endpoint was exposed, security teams should revoke active sessions, audit API keys, review admin accounts, rotate database credentials, and inspect logs for unauthorized activity. Given Metabase’s role as a central data hub, this flaw poses severe risks, potentially enabling broader breaches across connected systems. Self-hosted users are urged to patch immediately.