Maria Varmazis
@varmaz.is
1.8K followers 1.5K following 2K posts
🎙️ Host @ N2K CyberWire (T-Minus Space-Cyber Briefing, Hacking Humans) 🖌️ Cartoonist & painter 🚴🏻♀️ Cycling, astronomy, gardening, gaming 🪐 #NASAsocial alum 📍Massachusetts 💖 Read about what I'm making: mariamakesamess.com
![Dear Valued Framework Customer,
We are writing to inform you of a data breach at our business intelligence database provider Metabase that resulted in an attacker accessing customer names, email addresses, phone numbers, and addresses. Your information was in the database that was accessed in this breach. This breach did not include order or payment information.
We have full details on the incident below. We are deeply sorry for this breach of information, and are reviewing and improving our methodology for data storage in external database vendors.
We are also in the process of notifying the regulatory authorities in each region where relevant regulations exist. Note that while regulations in most regions do not require notification for breaches of names, email addresses, phone numbers, and addresses, we are sending this email to you regardless to ensure you have visibility and can take any actions needed.
What happened?
On August 6th, 2026 at 9am Pacific Time, Metabase notified us of a breach of their systems with the following email message:
On Monday, August 3, we discovered that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.
Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:
Rotate the credentials for every database connected to your instance; and
Review the admin accounts on your instance and remove anything you don't recognize.
We also discovered that the attacker was able to gain access to your instance. We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at [removed url].
(If y…](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:g5yoy3tgjg3m62n6w4jxukoj/bafkreibwhdbgdyrcuq6fxtk3ulpf5aysomvulmjyqwc2fa4nwb5mevjelm)
