Framework

Framework, the modular laptop manufacturer, disclosed exposure of customer data attributed to a zero-day vulnerability in Metabase, the open-source business intelligence tool the company used to query its own data. Reported exposed fields: names, email addresses, IP addresses, physical addresses, phone numbers, and VAT numbers.

No threat actor has been publicly attributed and the affected count has not been disclosed as of this writing.

Names, email addresses, physical addresses, phone numbers, IP addresses, and VAT numbers. No payment card data or credentials have been reported.

The VAT numbers are worth pausing on. VAT registration numbers identify business customers rather than consumers, which tells you the dataset spans both — and makes it directly useful for invoice and business email compromise fraud, where knowing a company's VAT number lends a fraudulent invoice legitimacy.

Framework's customers, who are a specific and somewhat unusual population: repair-minded, privacy-conscious technology buyers, many of whom chose the product on principle. A dataset combining name, home address, phone number, and email supports the standard progression of phishing and social engineering.

Business customers face the invoice fraud path described above. And IP addresses, retained routinely and classified almost never, narrow a customer to a city and often to an employer's network.

Since the exposure includes shipping addresses and product context, the same hardware-targeting concern that applies to fulfilment breaches applies here.

Using a well-regarded analytics tool to query production data rather than letting engineers run ad hoc queries against the live database is the correct architectural decision. It centralises access, creates an audit trail, and keeps credentials out of individual hands. Self-hosting it — as many privacy-minded companies do — keeps the data in the company's own environment rather than a vendor's.

A zero-day defeats the patching discipline that would otherwise cover this, and self-hosting shifts the responsibility for emergency patching onto the company. But the deeper issue is classification rather than patching: the BI tool is understood as a window onto data, so it is protected like a tool rather than like a datastore.

A business intelligence platform is not architecturally a datastore. It holds connection strings and renders results. That description is what keeps it off data inventories, and it is incomplete.

BI tools cache. They persist query results for performance, store dashboards built directly on customer tables, keep saved questions, and retain the history of every query an analyst has ever run. Compromise the dashboard and you inherit a curated extract of the most commercially relevant data in the business — already selected, joined, and filtered by people who knew exactly which fields mattered.

That extract is frequently more useful to an attacker than raw table access would be, and it exists in a system almost no data map records as holding customer data.

Determining scope in a BI compromise is materially harder than in a database compromise. With a database you can reason about tables and rows. With a dashboard you have to establish which cached result sets existed at the time of access, which saved questions had been run recently enough to hold live data, and what the query history reveals — a reconstruction that depends on logging the tool may not have retained.

Framework sells internationally, so GDPR applies for EU customers with a 72-hour supervisory authority deadline, UK GDPR for UK customers, and US state statutes for American customers, including California's 30-day rule under SB 446. The presence of VAT numbers confirms EU business customers and therefore EU obligations.