I just received an email about a limited data breach, leaking customer information (no billing info though). Do you guys think Framework is handling this well? The email looked very detailed and transparent to me.
The transparency and especially the expediency of notification is greatly appreciated, I’d say not only by the Framework team but also by Metabase. A 3 day turnaround by Metabase from initial discovery of the incident to notify business partners is impressive. And the Framework team took only 6 HOURS from receiving Metabase’s notice before internally confirming and notifying their customers!! That is unheard of!! It seems like most companies wait months (at minimum) before notifying customers (if they do at all) because they think any security issue will cause the public to lose trust in them.
These days, it’s not a matter of when you suffer a security incident. It’s how quickly and transparently you respond to it and notify your customers. In my opinion, the Framework team far exceeded expectations, and I anticipate any updates will be met with the same level of transparency. Other companies need to take note, this is how you handle a security incident.
Their privacy policy states Stripe is used for handling payments, and it was already stated in the email there was no payment information.
Its disappointing another company has chosen to share our personal information with another third party. While at this point I think all of my information has probably already been leaked, I still do not appreciate my data being shared with third party providers. Getting all your personal information leaked because a company you have never heard of or interacted with is getting insanely normalised.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: community.frame.work.
