Framework Data Breach 2026: What Happened, What Was Stolen, and What You Need to Know

How Many Customers Were Impacted

Framework stated it notified "all customers" — meaning the breach hit its entire customer base . However, Framework has not publicly disclosed the exact number of affected individuals. The company's spokesperson, Eric Schumacher, told TechCrunch that the breach affected "all customers" but declined to specify a number . One report estimated roughly 18,000 customers based on Framework's known user community size, but this is not an official figure and may be a significant underestimate .

The Upstream Vendor: Metabase

Framework blamed the breach entirely on Metabase, the open-source business intelligence (BI) platform that Framework used to host its analytics data . This is a textbook supply-chain attack — Framework's own systems were not directly breached, but a trusted third-party vendor was.

The Vulnerability: CVE-2026-72898

The attack vector was a critical unauthenticated SQL injection zero-day vulnerability in Metabase's software . Key characteristics:

• CVSS score: 10.0 (maximum severity) — the highest possible rating
• CVE ID: CVE-2026-72898
• Affected versions: Metabase versions 1.58 through 1.63
• Attack method: The exploit allowed a remote attacker to inject arbitrary SQL into the Metabase application database through the /reset_password endpoint, granting full administrator access without any credentials
• Impact: Once an attacker gained admin access, they could steal stored database credentials and any accessible data, including customer PII

What Metabase Itself Disclosed

Metabase disclosed the incident on August 6, 2026, revealing that its Metabase Cloud SaaS platform had been compromised via this previously unknown vulnerability . Key timeline and details:

• August 3, 2026: The exploitation occurred — three days before the patch was released
• August 6, 2026: Metabase notified affected cloud tenants, including Framework and form provider Tally
• August 7, 2026: The incidents became public
• Emergency patch: Metabase released fixes for versions 1.58+. Self-hosted instances running versions 1.58 through 1.63 were also vulnerable and required immediate updating

Metabase warned that, beyond customer data, the exploit could expose stored database credentials, tokens, API keys, and other sensitive configuration data from affected instances . This means the blast radius extended beyond just the customer data that Framework is disclosing — attackers could potentially pivot from Metabase into other connected systems.

Supply-Chain Context: A Wider Campaign

Framework was not the only company affected. As the Metabase investigation unfolded, at least five companies publicly confirmed they were compromised :

• Framework (August 7) — customer PII stolen
• Tally (August 7) — form builder; customer email addresses and password hashes exposed
• n8n (August 8) — workflow automation platform
• Kilo Code / Anaconda (August 9) — AI coding platform
• ChecklyHQ (August 10) — monitoring platform

This pattern shows that the Metabase zero-day was exploited as a general-purpose attack against multiple cloud tenants, not a targeted breach against Framework specifically.

What Framework Customers Should Do

Framework's official notification, as reported by multiple outlets, included guidance for customers. Based on the types of data stolen and standard breach response practices, affected customers should:

1. Watch for phishing attempts: Attackers now have names, email addresses, phone numbers, and physical addresses — all the ingredients for highly targeted phishing emails, SMS messages, or even physical mail scams
2. Monitor accounts for suspicious activity: Login IP addresses were exposed; if you reused passwords on other services, consider changing them
3. Do not click links in unexpected emails about the breach: Attackers will likely impersonate Framework or security services to trick victims into revealing more information or installing malware
4. Check official Framework communications only: The company said it is reviewing and improving its methodology for data storage and will provide updates through its official channels

Framework's spokesperson told TechCrunch the company is "deeply sorry for this breach of information" and is "reviewing and improving" its data storage methodology .

Key Takeaways

• Framework's entire customer database was compromised via a supply-chain attack on Metabase, not a direct breach of Framework's own infrastructure
• Stolen data includes PII (names, addresses, phone numbers, emails), but not payment or order information
• The vulnerability used was CVE-2026-72898, a CVSS 10.0 pre-authentication SQL injection in Metabase versions 1.58-1.63
• Framework has not disclosed exact customer numbers, though all customers were notified
• At least five companies were affected by the same Metabase zero-day campaign
• All self-hosted Metabase users on affected versions should have patched immediately in early August 2026