Related:
2 Likes
Kudos for the quick notification, this is indeed uncommon. And another plus for a notification that does not read like total legalese
I have a few questions that donāt seem to be mentioned by the notification, maybe @nrp can provide more details:
- What was/ is the business purpose for sharing the data with Metabase?
Additionally why was the full customer PII shared instead of anonymized or pseudonymized variants? - Is there evidence of the data being resold on the internet?
- Which other companies does Framework share our data with that fall into the category of ālegitimate business operationsā? And in what detail is our data shared?
- Will Framework (or Metabase) donate the list of affected users to HaveIBeenPwned ?
8 Likes
I too would like to say I appreciate the speed of the notification, but also disappointed in the initial sending of unnecessary data to the third party.
I do however trust that Framwork will actually change some policies or practices because of this. I just hope this is enough of a shock to teach them the required lessons and that no customers will get seriously impacted by the data that was taken.
2 Likes
This really is infuriating, though.
Metabase is not a critical third party, say, to handle payment processing.
They are an AI analytics company.
Itās maddening that an otherwise good (and ethical) company like Framework would choose to share user data with a third party, especially when it contains very specific, personally identifiable information!
Framework, if you want to do analytics, fine. But the data should be anonymized before any third-party is given access to it. Better yet, handle the analytics in-house using anonymized data.
15 Likes
I write about a slightly related problem, namely, the difficulty of changing oneās password on and for this forum. I am even unsure whether the forum account is the same as oneās Framework āuserā account.
1 Like
The full GDPR arsenal is not realistic for small company, that is true. But here weāre talking about very basic approach to data privacy, things that can be sorted out just by thinking about it during the design process.
Thereās a moment in a project when you choose which data to send. Instead of just sending everything, you select only what you need. Itās data management 101 really.
3 Likes
I agree in theory but I donāt see it working that way in practice.
Iām a software engineer, and out of every company I have ever worked in, I donāt think anyone has shouted more loudly about data minimisation or deletion more than I have. And in every case any such projects are regarded as pointless because they donāt contribute to the bottom line, or itās a problem that can be tossed to the lawyers, or (and this is probably the biggest one) colleagues donāt really care about DP in the way we would like them to.
I donāt know what the solution is to this, but perhaps we can observe that this scenario doesnāt come about from malice - itās a mixture of laziness, a lack of care, how business priorities are decided from the top, and people being too busy.
2 Likes
Sorry, did I read that correctly? Metabase just published an advisory for a 10.0/10 unauthenticated SQL injection, and thatās plausibly what caused this breach of all our data?! If so, that is (self-censoring many expletives) infuriating!!! I rarely post (here or elsewhere), but Iām awfully tempted to ask Framework to outright fire Metabase for that alone.
Edited to add: and the vulnerability is in the reset password API endpoint?! I would hope they would be really carefully considering security while writing such code. That advisory is absolutely surrealā¦
1 Like
I would not be surprised if a number of company customers now move to another customer data platform.
That said, an interesting feature of Metabase is that itās an open source product, and Iād assume development is funded by offering managed hosting. I donāt know if another company would necessarily be more secure - the internet has millions of WordPress instances, and theyāre hacked every day.
Would be nice to know what services Framework requested by Metabase in the first place?
Metabase is an open source data visualization and business intelligence tool that allows companies to visualize, analyze and explore data on their own terms.
If Metabase would be the store that send us our parcels, I could understand it somehow easier ā¦
I hope we get to hear and apology from whichever middle-tier marketing manager thought it was a good idea to hand of this data with no anonymization. With their name, billing address and email.
Maybe other Framework staff would like to share their data in solidarity?
It might give them insight into how vulnerable some of us will be feeling right now.
3 Likes
I think i would be interested to find out what questions / answers FW were getting from the data. Under UK law, they have to tell us.
This is what was lost in the databreach:
We confirmed that the following information was accessed:
- Full name
- Email address
- Login IPs
- Billing and shipping address information
- Country
- Address
- City
- State
- Zip code
- Phone number
- Company
Data breaches are a symptom of a larger prevailing issue: businesses just donāt respect our personal information. They are only ever a means to an end, such as for money, or efficiency, or insight into their customer base, etc. To me, the bare minimum for accepting Frameworkās use of Metabase is that my personal information is actually secure. The only way for that to happen is if itās properly encryptedā¦ or they never have it in the first place. I would prefer the latter.
To clarify, though, Iām not entirely sure what purpose Metabase serves for Framework, so I canāt speak on if they ought to abandon it. Maybe they are necessary for Framework to function as a business? (In my unprofessional opinion, I highly doubt that.)
While I appreciate Frameworkās quick response, there is nothing that can excuse the fact that hundreds of thousands or maybe millions of peopleās data are now on the black market. The only way to move forward is to make sure it never happens again. And the only way for that to happen is to stop unnecessarily sharing my personal information.
16 Likes
Well, I hope that within the next working days somebody of FW team will write here as a good PR and customer oriented company would do.
Right, @Destroya ?
4 Likes
Kudos for responding quickly, but this breach over Market Research sounds completely avoidable.
It was fun showing it off at major venues. I now have to hide the fact that I use Framework products, let alone mention them, for my own safety.
What a shame.
1 Like
Have I missed a more thorough follow up to this? Like othersā have said, I would like a follow up with more information, especially answering the questions raised by @dfh and others almost three weeks ago.
3 Likes
Today I received the first spam email to the email address that I used exclusively for the Framework registration. So, to me that is evidence that the stolen data are misused. The email contains my correct name and country. It is written in my native language (which is not English), and does not contain any typos or other mistakes (at least as far as I can tell 
). No surprise with the existing LLMs nowadays. The only obvious mistake is the postal address of the alleged sender in the last line of the email text. This address is obviously wrong.
Yes, this is inevitable, unfortunately. I also use per-provider email addresses, itās a good habit. I nearly clicked on something very plausible the other day, but stopped myself when I realised the provider and the email did not match up.
I got notified that my postal address had been stolen from Ricardo, the largest online auction site in Switzerland. So I guess we inevitably live in a world where you canāt live without getting our information stolen that we canāt easily change.
1 Like