Framework has disclosed a data breach affecting customer information, though the company stated that billing and payment data were not compromised. According to community discussion, the breach occurred through a zero-day vulnerability in Metabase, a third-party business intelligence platform that Framework uses.
According to Framework’s notice shared in the community forum, the incident exposed personally identifiable information including names, email addresses, and shipping addresses. The company emphasized that “no payment information” was accessed, as payment processing is handled separately through Stripe.
Framework’s response timeline drew praise from community members. The company notified customers within 6 hours of receiving notice from Metabase about the vulnerability. Metabase itself achieved a 3-day turnaround from initial discovery to notifying business partners of the flaw.
In response to the breach, Framework stated it is “evaluating the breadth and depth of data shared with business intelligence platforms, and scoping down their access to only the columns required for analysis.”
Community members offered mixed reactions to Framework’s handling. Some praised the speed and transparency of the notification compared to industry norms, while others questioned the characterization of the breach as “limited” given the scope of exposed personal information. Several users expressed concern about the practice of sharing customer data with third-party vendors, arguing that excessive data sharing created unnecessary risk.
One user noted a separate security concern: an “Action Required” email from Framework requesting payment method updates, sent days before the breach disclosure. The user flagged the potential for phishing attacks using breached customer data, comparing the email layout to what a sophisticated phishing attempt might resemble. The user suggested Framework follow practices adopted by Nordic banks, which removed payment links from customer emails to reduce phishing risks.
Some customers reported taking precautionary measures, including canceling payment cards used with Framework, while others expressed concern about targeted physical theft given the disclosure of customer addresses alongside product order information.
Key facts
- Framework confirmed a data breach involving customer personally identifiable information through a Metabase zero-day vulnerability
- Payment and billing information were not compromised, as Stripe handles payment processing separately
- Framework notified customers within 6 hours of receiving notice from Metabase; Metabase took 3 days from discovery to notify business partners
- Exposed data included names, email addresses, and shipping addresses
- Framework is reviewing data shared with third-party business intelligence platforms to limit access to necessary columns only