Framework Data Breach

Framework disclosed that attackers reached its Metabase Cloud instance through a zero-day vulnerability in the third-party business-intelligence provider, exposing customer names, email addresses, phone numbers, physical addresses, login IP addresses, and some business identifiers.

Framework said order and payment information, administrator access, and systems outside the affected instance were not compromised in preliminary findings. The company notified customers, rotated connected database credentials, and reviewed how vendors access stored data, while Metabase patched the cloud service and commissioned a forensic investigation. The incident highlights the privacy and supply-chain risks of giving external analytics providers access to customer databases.