Framework Computer account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Framework Computer’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
If your Framework Computer account was hacked: start recovery at the official page (frame.work/support), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Framework Computer account, step by step
These steps follow Framework Computer’s official process. Official links only: account recovery · password reset.
Read the notice Framework emailed you rather than a forwarded copy, and if you want to confirm it is genuine, type frame.work into the browser and go to Support from there instead of clicking anything.
You do not need to reset your Framework password over this breach, but if you reused that password anywhere else, change it in those other places - and turn on two-factor authentication for the mailbox you ordered with, since that address is now circulating with your name and phone number beside it.
Open your Framework account and note what is saved there: shipping address, phone number, order history. Having a baseline is what lets you spot a change later if someone talks their way into support pretending to be you.
Treat any unexpected message about a Framework order as unverified for the next few months, however accurate it sounds. Check order status only from your own account page, and report the attempts at reportfraud.ftc.gov so the pattern is on record.
If you bought through Framework for Business, tell whoever handles payments that VAT, EIN and billing email addresses were in the exposed set, and set the rule now that any bank-detail change is confirmed on a known phone number rather than by replying to the request.
Limit what a scammer can add to the leaked record: check whether your email turns up in known breach data, and get your name, address and phone off people-search sites, so a stolen order history cannot be enriched into a convincing phone call.
What trips people up with Framework Computer
- The data did not walk out of Framework's own store or out of your account. It was taken from Metabase, the analytics service Framework fed its order records into: Metabase's cloud platform was broken into on 3 August 2026 through an unauthenticated SQL injection flaw that handed the attacker administrator access, and Framework was told about it on 6 August. So there is nothing suspicious to find in your Framework login history - the copy that leaked was sitting in a vendor's database the whole time.
- Framework's notice to customers lists names, email addresses, phone numbers, billing and shipping addresses, login IP addresses and company names. Payment details were not in the set, and no Framework passwords or password hashes have been reported taken. That changes what you should actually do: this is a phishing and impersonation problem rather than an account-takeover emergency, and a panicked mass password reset is precisely the reflex the follow-up scam emails are written to trigger.
- Framework sells direct, so nearly every customer in that file has a genuine order history, a real shipping address and a working phone number attached to their name. Expect messages along the lines of 'there is a problem with your Laptop 13 shipment' or 'your mainboard order needs re-confirmation' that quote details which are entirely correct. Correct details only prove the sender has the leaked file, which anyone can buy - open frame.work yourself instead of following the link.
- Business buyers got a wider set than consumers: Framework for Business records also carried VAT and EIN numbers alongside billing email addresses. That is invoice-fraud material. Anyone who pays supplier invoices and receives a 'we have changed our bank details' message referencing a Framework order should verify it by calling a number they already had on file, not one printed in the message.
- The same intrusion reached other companies running Metabase, so a Framework notice does not cover everything you may have been caught by. The form builder Tally reported stolen email addresses and password hashes, and the AI coding tool Kilo Code reported names, emails and Slack access tokens. Those are separate incidents with separate actions - password hashes being involved at Tally, for instance, makes a real password change there worth doing.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Framework Computer's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Framework Computer?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Framework Computer). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Locked out of Framework Computer — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Framework Computer's dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Framework Computer sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Framework Computer (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Framework Computer itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Framework Computer account, answered
How did my Framework Computer account get hacked?
The most common cause isn't a hack of Framework Computer itself — it's credential stuffing: a password you used on Framework Computer leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Framework Computer login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Framework Computer account back?
Usually yes. Use the official recovery flow (https://frame.work/support) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new Framework Computer account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Framework Computer can lock it, before you start over.
The hacker placed orders or drained gift cards on my Framework Computer account — now what?
Report the orders as unauthorized through Framework Computer's support, dispute any card charges with your bank, and check saved addresses and payment methods for ones the attacker added. Loyalty points and gift-card balances are a favorite target because people don't watch them like a bank account — screenshot balances and include them in the report.
How do I stop my Framework Computer account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.