Framework Suffers Data Breach After Accountant Phished

Framework, a US-based company renowned for its repairable laptops, has suffered a data breach after an employee at its accounting service provider, Keating Consulting, fell victim to a phishing attack. The breach, confirmed by Framework, led to unauthorized access to customer data, including full names, email addresses, and outstanding balances for Framework purchases.

The incident, detailed in a notification sent to affected customers, occurred when a threat actor impersonated Framework's CEO and requested Accounts Receivable information from the accountant at Keating Consulting. The accountant, deceived by the phishing email, provided a spreadsheet containing sensitive customer information.

TechCrunch reported on the breach, noting that Framework, in an email to affected customers, stated, "On January 9th, at 4:27 am PST, the attacker sent an email to the accountant impersonating our CEO asking for Accounts Receivable information pertaining to outstanding balances for Framework purchases." The company further warned that the stolen information could potentially be used by hackers to impersonate Framework and solicit payment information.

Framework Computers, founded by former Apple and Oculus engineer Nirav Patel, has emphasized its commitment to customer privacy and security by implementing mandatory phishing and social engineering attack training for employees with access to customer information. Framework has also initiated an audit of the training and standard operating procedures of its accounting and finance consultants.

Highlighting the severity of the breach, BleepingComputer mentioned that Framework's Head of Finance notified Keating Consulting's leadership of the breach shortly after it was discovered — just 29 minutes after the accountant fell for the phishing email.

Framework has advised customers to be cautious of phishing risks and to verify the authenticity of any communication claiming to be from Framework. The company has stressed that it only sends emails from '[email protected]' and never requests payment information via email. Framework has also urged customers to contact its support team regarding any suspicious emails.

The breach, followed by the Raptor Technologies breach we reported last week, has put a spotlight on the vulnerabilities in digital security.