Framework customer data stolen by exploiting Metabase vulnerability
An unauthenticated SQL injection zero-day vulnerability in Metabase was exploited to breach Framework's customer analytics environment. Customer contact details, addresses and login IPs were stolen, and Framework notified all customers of the data breach.
Key facts
- Affected organisation
- Framework
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Customer contact details, addresses and login IPs
- Cause / method
- Exploitation of an unauthenticated SQL injection zero-day vulnerability in Metabase
- Location
- United States
If your data was exposed
Exposed dataPhone numberAddress
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- The theft of Framework customer data through the Metabase vulnerability and the breach notification sent to all customers were reported.
2 related reports
Other incidents at Framework
Phishing at Framework's external accountancy firm leaks customer data
Impact: Customer names, email addresses and outstanding balances
An employee at Framework's external accountancy firm was deceived by an email impersonating the CEO and sent a spreadsheet containing customer information to the attacker. The leaked information included customer names, email addresses and outstanding balances. Framework notified affected customers of the incident.
Related reports: 2 →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.