FRAMEWORK NOTIFIES CUSTOMERS OF DATA BREACH AT VENDOR

Framework, a manufacturer of repairable and upgradeable computers, notified all customers that their personal data was accessed during a breach of its business database provider Metabase. According to an email sent on Thursday, 6 August, the exposed information included customer names, login IP addresses, physical addresses, phone numbers and email addresses. Framework stated that payment information was not included in the breach. The company said it has rotated its credentials following notification and confirmed there were no unauthorised changes to administrator access or systems outside Metabase.

Metabase identified the attack on 3 August and identified an "unknown (0-day) vulnerability" as the method used to access the data, which the provider has now patched. Framework said it is working with a third-party forensic investigation firm to determine the full scope of the incident. The company stated it is reviewing and improving its methodology for data storage with external database vendors. Metabase's findings and security recommendations remain preliminary at this stage.

The breach occurs as Framework faces separate commercial pressures. The company raised prices in January and again in March owing to component cost increases and ongoing memory shortages. Framework recently collected preorders for its Laptop Pro model but was forced to include less RAM than originally advertised in some orders and offered full refunds to affected customers.