Threat Intelligence Brief
Curated summary with source attribution
Source: community.frame.work
Threat Risk: Medium
Victim: Framework customers
Incident: Exposure of customer PII through a third-party business intelligence platform.
Impact: Risk of identity theft, fraud, and targeted phishing due to the leak of names and billing addresses.
Attacker: Unidentified threat actors
Analysis: The incident stemmed from Framework sharing excessive PII, including full names and billing addresses, with the business intelligence platform Metabase. This lack of data minimization created an unnecessary attack surface, leading to the exposure of customer data. Such breaches typically facilitate targeted phishing and identity theft campaigns.
Recommendations: Implement strict data minimization policies to ensure third-party vendors only receive essential data.; Conduct comprehensive data privacy audits to map PII flow across all external integrations.; Enforce the principle of least privilege for all business intelligence and analytics platform access.
Source: Framework Community Forum
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-07 16:40 UTC
Data breach resulting from a third-party supply chain attack. Exposure of names, email addresses, phone numbers, and physical addresses for all customers. The breach originated from a zero-day vulnerability within Metabase, allowing attackers to gain unauthorized access to customer databases hosted on cloud servers. This incident underscores the inherent risks of third-party supply chain dependencies, where a single vulnerability in a service provider can compromise numerous downstream clients. While financial data remained secure, the exposure of PII across the entire customer base increases the risk of targeted phishing.
Corroborating source: techcrunch.com
Update — 2026-08-07 19:14 UTC
Data breach resulting from a zero-day exploit in the Metabase database platform. Exposure of customer PII including names, login IPs, addresses, phone numbers, and emails. The breach originated from a zero-day vulnerability within Metabase, a database tool used by Framework. Attackers leveraged this flaw to exfiltrate PII, including addresses and phone numbers, though financial data remained secure. This incident highlights the persistent risk of relying on third-party SaaS providers for sensitive data storage.
Corroborating source: engadget.com
Update — 2026-08-08 20:37 UTC
Data breach resulting from an upstream attack on Metabase. Exposure of names, emails, phone numbers, and physical addresses for all customers. The breach originated from a zero-day vulnerability within Metabase, a business intelligence provider used by Framework. Attackers exploited this flaw to access cloud-hosted databases containing sensitive customer PII. This event demonstrates how a single vulnerability in a SaaS provider can compromise multiple downstream organizations.
Corroborating source: newsbytesapp.com
Update — 2026-08-09 15:42 UTC
Data breach via a zero-day SQL injection vulnerability in Metabase. Exposure of customer names, login IP addresses, physical addresses, phone numbers, and email addresses. Attackers exploited a zero-day SQL injection flaw in Metabase versions 1.58 and above to gain administrative access to the application database. This vulnerability allowed the theft of customer PII from Framework’s business intelligence environment. The incident underscores the inherent risks associated with third-party SaaS vendor dependencies.
Corroborating source: notebookcheck.net
Update — 2026-08-09 16:22 UTC
Data breach exposing PII. Leakage of customer addresses and phone numbers. Framework confirmed a data breach resulting in the leak of customer physical addresses and phone numbers. This exposure significantly increases the risk of targeted phishing and social engineering campaigns against their user base.
Corroborating source: videocardz.com
Update — 2026-08-09 17:24 UTC
Data breach via a zero-day vulnerability in Metabase Cloud. Exposure of PII including names, emails, phone numbers, and physical addresses for all customers. Attackers leveraged a zero-day vulnerability in the Metabase Cloud platform to exfiltrate personal information from Framework. While payment data remained secure, the exposure of physical addresses and login IPs increases the risk of targeted phishing. The vulnerability has since been patched by the software provider.
Corroborating source: cnet.com
Update — 2026-08-09 18:15 UTC
Data breach caused by a zero-day vulnerability in a third-party BI provider. Exposure of PII increasing the risk of targeted phishing and social engineering attacks. Attackers exploited a zero-day vulnerability in Metabase Cloud versions 1.58 and above to access Framework’s business intelligence instance. The breach exposed PII including names, emails, and shipping addresses, although financial and order data remained secure. This incident highlights the systemic risk of third-party BI tool integrations and the importance of the principle of least privilege for data access.
Corroborating source: techmymoney.com
Update — 2026-08-09 18:36 UTC
Customer data breach resulting from a Metabase zero-day exploit. Exposure of names, emails, physical addresses, and IP addresses for all Framework customers. The incident stems from a critical SQL injection vulnerability in Metabase (v1.58+), allowing attackers to gain administrator-level access to connected databases. By exploiting the password-reset endpoint, unauthorized actors accessed Framework’s internal customer contact lists. This highlights the risk of over-provisioning data access to third-party analytics platforms.
Corroborating source: finance.biggo.com
Update — 2026-08-11 09:10 UTC
Customer data breach via a Metabase zero-day vulnerability. Unauthorized access and loss of customer data. Threat actors exploited a previously unknown vulnerability in the Metabase platform to gain unauthorized access to Framework’s internal data. This incident highlights the significant risk that business intelligence tools pose when they become entry points for data exfiltration. The breach demonstrates the high impact of zero-day flaws in tools with direct database connectivity.
Corroborating source: theregister.com