Computer maker Framework notifies ‘all customers’ of a data breach

Framework builds laptops you can fix yourself. Screwdrivers included. Parts labeled. Manuals public. The pitch is control — you own the hardware, you decide its lifespan. That promise just collided with a reality the company cannot repair: hackers now hold the personal details of every person who bought in.

The breach notice landed Thursday. Customers posted screenshots. Framework's spokesman Eric Schumacher confirmed to TechCrunch that "all customers" were affected. He would not attach a number. Analysts estimate hundreds of thousands of units sold. That is a lot of exposed addresses, phone numbers, and email inboxes. The company calls it an upstream incident. The upstream vendor is Metabase, a business intelligence platform that hosts analytics dashboards in the cloud. Metabase disclosed its own breach days earlier, blaming a zero-day vulnerability — an unknown flaw exploited before any patch existed. The attackers used it to reach into customer databases sitting on Metabase's cloud servers. Framework's instance was one of them.

Zero-day is a convenient word. It suggests inevitability. Nobody could have stopped it. That narrative suits both companies. Metabase gets to frame the intrusion as an act of god rather than a failure of architecture. Framework gets to say the breach happened outside its walls. But Framework chose Metabase. Framework shipped customer data there. Framework decided what data to send. The zero-day may have opened the door, but Framework built the hallway and led the data through it.

The notification insists payment information was not touched. That is the standard first reassurance. It is also the least meaningful. Names, emails, phones, and physical addresses are the scaffolding of identity theft. They enable phishing that looks legitimate because it references your recent order. They enable SIM swaps. They enable mail interception. They enable doxxing. A credit card number can be cancelled. A home address cannot.

Framework's modular design philosophy argues that complexity should be visible and replaceable. The motherboard is not a mystery. The battery is not glued shut. The same clarity should apply to data flows. Which vendors touch customer records? What data do they receive? How long do they keep it? What contractual safeguards exist? The breach notice answers none of this. It offers a vendor name, a vulnerability label, and a promise to investigate. The investigation will produce a report. The report will use words like "sophisticated actor" and "enhanced monitoring." The data will remain stolen.

Niche hardware makers survive on trust. Their customers pay premiums for ethics — repairability, transparency, longevity. Those customers tend to be technically literate. They read breach notices. They notice when a company says "all customers" but won't say how many. They notice when the fallback is a vendor's blog post about a zero-day. They notice the absence of a direct apology.

Metabase did not respond to press inquiries. That silence is its own statement. A vendor that cannot answer questions after losing client data is a vendor that should not hold client data. Framework's next move matters more than its last press release. It can publish the data processing agreement. It can disclose the exact fields shared. It can commit to a timeline for moving analytics in-house or to a provider with a cleaner record. It can offer affected customers something more than a form email — credit monitoring, identity protection, a direct line to human support.

The modular laptop proves you can design for repair. The breach proves Framework did not design for resilience. The two are not the same. One is about screws and ribbons. The other is about architecture and accountability. Customers who bought a machine they could open with a screwdriver just learned their data was locked in a black box they never agreed to trust. That contradiction is the story. Everything else is noise.