While I'm impressed with Framework's handling of this issue, I can't help but notice how this was yet another analytics platform breach. CRM tools and analytics platforms (Salesforce, Mixpanel, now Metabase - I'm sure I'm forgetting some) are common vectors to get access to customer metadata these days.
I don't see a solution to this in the near future. I initially thought up something quite simple: assign every customer a unique ID and use that where possible to reference a customer. That solution, however, renders the analytics and CRM tools nearly useless. There has to be a better way, though, other than haphazardly giving out customer metadata to other vendors. All of that information should stay in-house.
As for why metadata is important: I've said this before, but metadata can't easily be changed. I'd much prefer having my password or credit card number leaked in plaintext since I can change those identifiers trivially. I can't change my name, phone number, or address as easily.
> We are writing to inform you of a data breach at our business intelligence database provider Metabase that resulted in an attacker accessing customer names, email addresses, phone numbers, and addresses. Your information was in the database that was accessed in this breach. This breach did not include order or payment information.
> We have full details on the incident below. We are deeply sorry for this breach of information, and are reviewing and improving our methodology for data storage in external database vendors.
> We are also in the process of notifying the regulatory authorities in each region where relevant regulations exist. Note that while regulations in most regions do not require notification for breaches of names, email addresses, phone numbers, and addresses, we are sending this email to you regardless to ensure you have visibility and can take any actions needed.
> What happened?
> On August 6th, 2026 at 9am Pacific Time, Metabase notified us of a breach of their systems with the following email message:
> On Monday, August 3, we discovered that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.
> Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:
> Rotate the credentials for every database connected to your instance; and
> Review the admin accounts on your instance and remove anything you don't recognize.
> We also discovered that the attacker was able to gain access to your instance. We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at [removed url].
> (If you do not have access to the Metabase Store, are having issues accessing the report, or do not want to click on a link in an unexpected email, you can log into your instance directly and reach us at Help > Get help in the grid menu in the upper right hand corner. We'll confirm this message is from us and email you the report.)
> This report is based on our own application logs. We did not query or read the data in your connected databases.
> Depending on the jurisdictions in which you operate and kinds of data your instance connects to, you may have notification obligations under applicable laws. If you have concerns in this regard, we recommend you assess potential notification obligations with your company’s legal or compliance experts.
> We regret any inconvenience this incident may cause you, and we are here to support you. If you have questions, please reply to this email or email us at [removed email address], and we'll get back to you as quickly as we can.
> Sameer Al-Sakran
> Founder and CEO
> Metabase
> We immediately investigated the logs Metabase provided to us and confirmed that our database instance was accessed by the attacker. We confirmed that the following information was accessed:
> - Full name
> - Email address
> - Login IPs
> - Billing and shipping address information
> - Country
> - Address
> - City
> - State
> - Zip code
> - Phone number
> - Company
> For Framework for Business customers, we are investigating whether the following information may additionally have been accessed:
> - Company
> - Phone
> - VAT
> - EIN
> - Billing Email
> No other personally identifiable information, order information, or payment information was accessed.
> Note that Metabase has additionally flagged:
> Important: This is a preliminary update based on our current knowledge.
I say this as a fan of a lot of what Framework is doing.
Lets not pretend we do not all -know- virtually every SaaS sucks ass at security because it slows down sales.
Companies that use these easy button services anyway are knowingly putting PII at risk and any liability should fall on those decision makers.
If you do not have the security and infra staff to take user data in house securely, in highly auditable secure enclaves, then you should not store it at all.
Here's what an email from metabase looks like for those affected:
On Monday, August 3, we discovered that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.
Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:
Rotate the credentials for every database connected to your instance; and
Review the admin accounts on your instance and remove anything you don't recognize.
We also discovered that the attacker was able to gain access to your instance. We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at https://store.metabase.com.
(If you do not have access to the Metabase Store, are having issues accessing the report, or do not want to click on a link in an unexpected email, you can log into your instance directly and reach us at Help > Get help in the grid menu in the upper right hand corner. We'll confirm this message is from us and email you the report.)
This report is based on our own application logs. We did not query or read the data in your connected databases.
Depending on the jurisdictions in which you operate and kinds of data your instance connects to, you may have notification obligations under applicable laws. If you have concerns in this regard, we recommend you assess potential notification obligations with your company’s legal or compliance experts.
We regret any inconvenience this incident may cause you, and we are here to support you. If you have questions, please reply to this email or email us at eventresponse@metabase.com, and we'll get back to you as quickly as we can.
Sameer Al-Sakran
Founder and CEO
Metabase
Based on what they shared in terms of logs and summary, the attacker was scanning tables for valuable data. They took the first N rows from various tables in connected DBs, kind of at random it seems. Possibly some kind of regexing. Here's an example timeline:
| Time | Event |
| --- | --- |
| 13:00 | Access gained and authenticated as the administrator account |
| 13:01 – 13:12 | 54 queries were run through that session |
| 13:14 | API key was created (key ID `1`) tied to a service account |
| 13:14 – 13:17 | 19 further queries were run through the API key |
| 13:17 | API key was deleted |
I share a similar feeling. I don't have a Framework but I do self-host Metabase. Reading this headline is how I learned of the 0-day and updated my pod.
> Maybe Framework is handling things well, but now with their addresses out everyone who talked publicly about their recent orders should be considered at risk of targeted physical theft due to the current prices.
Am I missing something or is this user out of his mind ? This ain't Bitcoin, it's just a damn laptop.
I do wonder if this has anything to do with the fact that Framework has taken payment from me 3 days ago, yet my order still shows as "pre-order accepted". No acknowledgement of payment, no shipping ETA.
That's been the status since I placed the pre-order months ago and paid the reservation price (£100 IIRC). The full payment was taken on Tuesday though, and nothing changed. It should have shipped by Friday.
Just to update, on Monday I finally received the shipping notification. Now the status changed to order shipped. It should arrive tomorrow if everything goes to plan.
I suspect the order was stuck but they got it unstuck and shipped after I opened a support case.
At some point I almost bought a Framework laptop, just didn't click the Order button. I had my address etc already filled in, so because of that I also got that email from Framework this morning. From a technical perspective I guess it makes sense that Metabase has my personal information, but it's still kind of crazy to think how much personal information you're sending "out there" just by, for example, checking a final price of a product including shipping.
> Its disappointing another company has chosen to share our personal information with another third party
This forum poster would be… shocked to see how many SaaS companies are critical dependencies at most tech companies.
Imo, we need to get better at self hosting these kinds of tools. When I did a brief stint in BI tooling, we were basically using local tools with data exported from (gasp) SAP, and there was a dinky windows server behind someone’s desk where it’d run automated reports based on what we’d build and send out emails.
Certainly orders of magnitude cheaper. Maybe there was occasional downtime, but it didn’t really matter. You could always get the Oncall to generate the report you needed anyways
23 comments
[ 0.29 ms ] story [ 17.7 ms ] threadI don't see a solution to this in the near future. I initially thought up something quite simple: assign every customer a unique ID and use that where possible to reference a customer. That solution, however, renders the analytics and CRM tools nearly useless. There has to be a better way, though, other than haphazardly giving out customer metadata to other vendors. All of that information should stay in-house.
As for why metadata is important: I've said this before, but metadata can't easily be changed. I'd much prefer having my password or credit card number leaked in plaintext since I can change those identifiers trivially. I can't change my name, phone number, or address as easily.
> Dear Valued Framework Customer,
> We are writing to inform you of a data breach at our business intelligence database provider Metabase that resulted in an attacker accessing customer names, email addresses, phone numbers, and addresses. Your information was in the database that was accessed in this breach. This breach did not include order or payment information.
> We have full details on the incident below. We are deeply sorry for this breach of information, and are reviewing and improving our methodology for data storage in external database vendors.
> We are also in the process of notifying the regulatory authorities in each region where relevant regulations exist. Note that while regulations in most regions do not require notification for breaches of names, email addresses, phone numbers, and addresses, we are sending this email to you regardless to ensure you have visibility and can take any actions needed.
> What happened?
> On August 6th, 2026 at 9am Pacific Time, Metabase notified us of a breach of their systems with the following email message:
> On Monday, August 3, we discovered that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.
> Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:
> Rotate the credentials for every database connected to your instance; and
> Review the admin accounts on your instance and remove anything you don't recognize.
> We also discovered that the attacker was able to gain access to your instance. We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at [removed url].
> (If you do not have access to the Metabase Store, are having issues accessing the report, or do not want to click on a link in an unexpected email, you can log into your instance directly and reach us at Help > Get help in the grid menu in the upper right hand corner. We'll confirm this message is from us and email you the report.)
> This report is based on our own application logs. We did not query or read the data in your connected databases.
> Depending on the jurisdictions in which you operate and kinds of data your instance connects to, you may have notification obligations under applicable laws. If you have concerns in this regard, we recommend you assess potential notification obligations with your company’s legal or compliance experts.
> We regret any inconvenience this incident may cause you, and we are here to support you. If you have questions, please reply to this email or email us at [removed email address], and we'll get back to you as quickly as we can.
> Sameer Al-Sakran
> Founder and CEO
> Metabase
> We immediately investigated the logs Metabase provided to us and confirmed that our database instance was accessed by the attacker. We confirmed that the following information was accessed:
> - Full name > - Email address > - Login IPs > - Billing and shipping address information > - Country > - Address > - City > - State > - Zip code > - Phone number > - Company
> For Framework for Business customers, we are investigating whether the following information may additionally have been accessed:
> - Company > - Phone > - VAT > - EIN > - Billing Email
> No other personally identifiable information, order information, or payment information was accessed.
> Note that Metabase has additionally flagged:
> Important: This is a preliminary update based on our current knowledge.
I just requested a full delete courtesy of GDPR and CCPA and encourage others to do the same.
Lets not pretend we do not all -know- virtually every SaaS sucks ass at security because it slows down sales.
Companies that use these easy button services anyway are knowingly putting PII at risk and any liability should fall on those decision makers.
If you do not have the security and infra staff to take user data in house securely, in highly auditable secure enclaves, then you should not store it at all.
Still not sure what to do with this information. It's not like I can change any of the compromised information.
Am I missing something or is this user out of his mind ? This ain't Bitcoin, it's just a damn laptop.
I suspect the order was stuck but they got it unstuck and shipped after I opened a support case.
This forum poster would be… shocked to see how many SaaS companies are critical dependencies at most tech companies.
Imo, we need to get better at self hosting these kinds of tools. When I did a brief stint in BI tooling, we were basically using local tools with data exported from (gasp) SAP, and there was a dinky windows server behind someone’s desk where it’d run automated reports based on what we’d build and send out emails.
Certainly orders of magnitude cheaper. Maybe there was occasional downtime, but it didn’t really matter. You could always get the Oncall to generate the report you needed anyways