Laptop manufacturer Framework has suffered a data leak and is warning its customers about leaked information. Contact and delivery data of private and commercial customers were lost – however, payment and order information were not, according to Framework. Attackers apparently exploited a zero-day vulnerability in Metabase; the database manufacturer has released updates and sealed its cloud instances.
In an email to its customers, which heise online has seen, the manufacturer writes that the following customer data was exfiltrated by the attack on Metabase:
Full name,Email addresses for login and billing,Login IP address(es),Billing and shipping address,and for business customers, the company name and tax information.
To prevent future incidents, they are also examining how much information is shared with platforms for “Business Intelligence”, the email further states. In addition, they have informed the respective supervisory authorities and commissioned an IT forensics company to investigate. Framework has changed the access credentials for its Metabase cloud database.
Framework has made a name for itself with its repairable and upgradeable notebooks, such as the Laptop 13. No component is glued; battery, display, touchpad, and more can be easily replaced. Most recently, the company introduced the Laptop 13 Pro, marking a push into Linux as well. In the laptop manufacturer's forum, customers are discussing the extent of the leak; a public statement on the company blog or its social media accounts is still pending at this time.
