Breaches and incidentsBriefReported by a reputable outlet, citing the company
Metabase Cloud zero-day used to reach customer databases; Framework notifies all customers
Framework notified “all customers” that attackers took names, emails, phone numbers and physical addresses (no payment data).
- Disclosed
What happened
- Framework notified “all customers” that attackers took names, emails, phone numbers and physical addresses (no payment data). It blamed an upstream attack on business-intelligence provider Metabase; TechCrunch reports Metabase said attackers used a zero-day to reach customer databases connected to its cloud servers, including Framework’s cloud instance. Count not given.
- Root cause: a zero-day in Metabase’s cloud service (no CVE or details found). Note: the catalogue’s UNVERIFIED table lists a “Metabase 10.0 zero-day” from a single newsletter; this TechCrunch report partly corroborates a Metabase zero-day but not the version.
- No attacker named.
- Customer notices sent.
Sources
- https://techcrunch.com/2026/08/07/computer-maker-framework-notifies-all-customers-of-a-data-breach/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-in-august-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.