Framework customers’ data was stolen by attackers after a successful attack on a supplier to the laptop maker.

Attackers stole data from Framework customers. Framework builds the Framework Laptop: a fully upgradeable device that allows the end customer to easily swap out components. The device is also available from us and we started working on it at the end of last year.

The hackers obtained a spreadsheet containing customers’ full names, email addresses, and outstanding payments. Although this data is not particularly sensitive, it can be used to set up successful targeted phishing campaigns. Imagine a fraudulent email asking a customer to transfer the outstanding amount, with all the correct information included in the email but an incorrect account number.

Not the CEO

Such campaigns work because this is how criminals obtained the information. Through Social Development They were able to convince an employee of Framework’s external accounting firm to release the confidential information. The victim in question believed the fraudulent correspondence came from the CEO.

The successful attack highlights two things: hacker attacks often have more of a human component than a technical one, and you are only as safe as your least secured supplier. Framework itself may have its affairs in order, but by relying on a less secure accounting firm it still left itself vulnerable. The office in question will in future train employees who handle customer data.