Framework Laptop Maker Faces Data Breach via Metabase Zero-Day Exploit

• •Framework Computer's customer data was exposed due to a Metabase zero-day vulnerability.
• •The breach affects all customers, revealing names, emails, phone numbers, and addresses.
• •Metabase has patched the vulnerability and launched an investigation into the incident.

Framework Computer has reported a data breach affecting all its customers due to a zero-day vulnerability in Metabase, a third-party business intelligence provider. The breach exposed customer names, email addresses, phone numbers, and shipping addresses, but not payment or order information. The vulnerability, which affects Metabase versions 1.58 and above, was exploited by hackers to access Framework's cloud instance. Framework has taken steps to secure its databases by rotating credentials and is currently investigating the full scope of the breach. Metabase has patched the zero-day vulnerability and is conducting its own investigation. The incident has raised concerns about data security in third-party services used by companies. Framework previously reported a breach in January 2024 involving another third-party firm, indicating ongoing vulnerabilities in their supply chain.