Full Report
Repairable hardware is little comfort when personal details escape
Analysis Summary
# Incident Report: Framework Customer Data Breach via Metabase Zero-Day
## Executive Summary
Laptop manufacturer Framework suffered a data breach originating from a zero-day vulnerability in Metabase, a third-party business intelligence and analytics platform. The attacker exploited a critical flaw to gain access to Framework’s data instance, potentially exposing the personal information of all Framework customers. The incident was mitigated through rapid patching by the vendor and credential rotation by Framework, though personal identifiers were exfiltrated.
## Incident Details
- **Discovery Date:** August 3, 2026 (by Metabase); August 6, 2026 (notified to Framework)
- **Incident Date:** Early August 2026
- **Affected Organization:** Framework Computer Inc.
- **Sector:** Consumer Electronics / Hardware Manufacturing
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Early August 2026 (exact time undisclosed)
- **Vector:** Zero-day vulnerability in Metabase (versions 1.58+).
- **Details:** The attacker targeted the Metabase Cloud service using a previously unknown vulnerability involving a password-reset endpoint.
### Lateral Movement
- **Details:** The exploit allowed the attacker to inject arbitrary SQL against the Metabase application database. From there, the attacker gained administrative access to the Framework instance, allowing them to query connected databases.
### Data Exfiltration/Impact
- **Details:** The attacker queried and exported customer data. Exposed information includes names, email addresses, phone numbers, physical addresses, and login IP addresses. For business customers, VAT/EIN numbers and billing emails were also compromised.
### Detection & Response
- **Discovery:** Metabase detected the attack on August 3, 2026.
- **Notification:** Metabase notified Framework on August 6, 2026, at 09:00 PT.
- **Response:** Framework rotated all database credentials and initiated a third-party forensic investigation. Metabase patched the vulnerability and blocked the malicious endpoints.
## Attack Methodology
- **Initial Access:** Exploitation of a zero-day vulnerability in the Metabase password-reset endpoint.
- **Persistence:** Potential creation of rogue API keys or admin accounts (per Metabase advisory).
- **Privilege Escalation:** Attacker gained administrative access to the Metabase instance.
- **Discovery:** The attacker was able to see and query all databases connected to the Metabase environment.
- **Lateral Movement:** SQL injection used to move from the Metabase application layer to the connected customer data tables.
- **Exfiltration:** Exporting query results containing customer PII.
- **Impact:** Unauthorized access and theft of sensitive customer data.
## Impact Assessment
- **Financial:** Undisclosed; costs involve third-party forensics and potential regulatory fines.
- **Data Breach:** High. Includes names, emails, phones, and physical addresses for "all customers."
- **Operational:** Low. Core manufacturing and sales systems remained operational.
- **Reputational:** Moderate. Contradicts Framework’s mission of consumer empowerment; "repairable hardware is little comfort" when privacy is compromised.
## Indicators of Compromise
- **Network:** Malicious requests to the Metabase password-reset endpoint (URLs defanged: `hxxps[://]metabase[.]cloud/auth/reset`).
- **Behavioral:** Unauthorized SQL queries originating from the Metabase administrative interface; unusual data export volumes from Metabase.
## Response Actions
- **Containment:** Metabase blocked the vulnerable endpoints and deployed a global patch to its cloud service.
- **Eradication:** Framework rotated credentials for every database connected to Metabase.
- **Recovery:** Notification to customers and regional regulators; engagement of a third-party forensic firm to verify the extent of the breach.
## Lessons Learned
- **Third-Party Risk:** Even secure hardware companies are vulnerable through their software supply chain and analytics vendors.
- **Zero-Day Preparedness:** Rapid vendor notification and internal credential rotation are critical to limiting "blast radius."
- **Data Minimization:** Evaluating whether all customer PII (like physical addresses) needs to be accessible via a third-party BI tool.
## Recommendations
- **Audit Data Access:** Review and limit the specific data fields synced to external analytics platforms (e.g., mask physical addresses if only regional trends are needed).
- **Enhanced Monitoring:** Implement alerting for large data exports or unusual SQL queries within BI tools.
- **Session Management:** Enforce strict session timeouts and multi-factor authentication (MFA) for all administrative interfaces on third-party SaaS platforms.