What should I do immediately after a data breach?

Change your password for the affected account and any other account where you reused that password. Enable two-factor authentication. Monitor your bank and credit card statements. Place a free credit freeze at Equifax, Experian, and TransUnion. If your Social Security number was exposed, file an identity theft report at IdentityTheft.gov.

How long do companies have to notify me after a data breach?

In the US, notification timelines vary by state — typically 30 to 90 days after a breach is confirmed. Under GDPR in Europe, companies must notify regulators within 72 hours. Many states require individual notification "in the most expedient time possible." Companies often delay notification while investigating.

Should I freeze my credit after a data breach?

Yes. A credit freeze prevents new accounts being opened in your name without your explicit unfreeze. It is completely free at all three major bureaus, does not affect your credit score, and does not impact existing accounts. Unfreeze temporarily when you need to apply for credit, then refreeze immediately.

Framework Laptop Breach: Hackers Stole Customer Data Through a Vendor's Zero-Day

Your Laptop Company Didn't Get Hacked. You Still Need to Act Today.

Here's the uncomfortable truth about the Framework laptop data breach: Framework itself wasn't hacked. A company most of its customers have never heard of — a business-intelligence vendor called Metabase — was. And because Framework had handed Metabase access to customer data for internal analytics, that one weak link was all it took to expose everyone.

If you're a Framework customer, your name, email, phone number, home address, and the IP address you logged in from are now in the hands of people who didn't earn them and shouldn't have them. If you're not a Framework customer, this is still your problem, because the same setup — "we didn't get breached, our vendor did" — is happening at companies you do use, probably right now, and you won't hear about most of them.

What actually happened

Framework, the company known for repairable, modular laptops, notified all of its customers around August 6-7, 2026 that their data had been exposed. The breach didn't start with Framework's own servers. It started at Metabase, a third-party analytics tool Framework used to make sense of customer data. Attackers exploited a zero-day vulnerability — a flaw nobody knew about yet, including Metabase — to get in.

From there, they walked out with:

Full names
Email addresses
Phone numbers
Physical/home addresses
Login IP addresses

The good news, such as it is: payment card details were not exposed. Framework said the breach affected all of its customers, though it hasn't given an exact number. A company spokesperson, Eric Schumacher, confirmed the scope to TechCrunch. Framework has since rotated its credentials, says it found no evidence attackers got into any systems beyond Metabase, and has brought in a third-party forensics firm to dig further.

Why "we didn't get breached" is a meaningless sentence now

Every modern company — yours, mine, the one that makes your laptop — plugs into a web of vendors: analytics tools, support platforms, payment processors, email marketers, CRM systems. Each one of those vendors gets a copy of, or a pipeline into, your data. You never agreed to give Metabase your address. You gave it to Framework. Framework decided to share it with a vendor for business purposes. That vendor got popped by a zero-day nobody could have predicted.

This is the pattern behind a huge share of the "breaches" you hear about now. The company you trust isn't lying when it says its own systems are secure — the exposure happened one hop away, somewhere in its supply chain, completely outside your view and often outside its full control too. You have no way to audit that chain. You just have to assume it's happening constantly, in places you'll never be told about, and act accordingly.

What this data is actually used for

Names, emails, phone numbers, physical addresses, and login IPs sound "less bad" than passwords or credit cards. They're not. This is the exact toolkit for:

Highly targeted phishing — an email that references your real name, address, or recent order looks legitimate and bypasses your instincts.
Phone and SMS scams (smishing/vishing) — scammers posing as "Framework support" calling or texting the number they now have.
Physical-world risk — a real home address tied to a real name, in a breach, is a category of exposure that's genuinely hard to walk back.
Account takeover elsewhere — attackers use this data to answer security questions or social-engineer support reps at other companies pretending to be you.

Do this today

1. Assume Framework-branded emails and texts could now be spoofed. Don't click links in anything claiming to be from Framework about "verifying your account" or "securing your data." Go directly to framework.com by typing it yourself if you need to check anything.

2. Turn on 2FA — or better, switch to a passkey — everywhere you can. Your password wasn't stolen here, but attackers now have enough personal detail to make convincing password-reset attempts elsewhere. A second factor (an authenticator app, not SMS if you can help it) or a passkey stops account takeover even if they guess or reset your password.

3. Freeze your credit — it's free, and it takes ten minutes. Even though card numbers weren't exposed, name + address + phone is enough for some fraud attempts. Contact each of the three major credit bureaus (Equifax, Experian, TransUnion) and request a freeze. It's free by law, reversible anytime, and blocks anyone from opening new credit in your name.

4. Watch for spear-phishing that name-drops Framework specifically. Scammers move fast after a breach notification goes public. Expect emails or texts referencing "your recent Framework order," "account security update," or "verify your shipping address" — all designed to feel legitimate because they now have real details to work with.

5. Consider a data-removal service. Your address and phone number are almost certainly already sitting on data-broker sites, which is a separate problem from this breach — but a breach like this is a good trigger to finally deal with it. Data-removal services scrub your info from the broker sites that resell it, cutting off one more pipeline attackers use to build convincing scams.

6. Don't wait for "the official all-clear." Companies rarely tell you exactly what to do beyond "we take security seriously." Forensics investigations take weeks or months. Acting now costs you ten minutes; waiting costs you nothing until it costs you everything.

The recap: do this now

Don't click links in unexpected Framework emails or texts — go to the site directly
Enable 2FA or passkeys on your Framework account and anywhere you reuse similar info
Freeze your credit at Equifax, Experian, and TransUnion — free, reversible, effective
Expect targeted phishing that uses your real name, address, or order details to seem legit
Look into a data-removal service to scrub your address and phone from broker sites
Treat every "vendor breach" story the same way — the company that got hit doesn't have to be one you signed up with directly for it to hit you

The lesson isn't "don't trust Framework." It's that trusting any single company was never the full picture — you're trusting its entire vendor chain, whether you know their names or not.