Financial technology company Abrigo has restored most functionality of its Sageworks risk management application after taking it offline on October 30 to investigate suspicious activity, an incident BleepingComputer described as a suspected cyberattack. Borrower-facing features remain unavailable. The company said it serves more than 2,400 entities across the United States.
Abrigo said it disabled the Sageworks application at approximately 11:25 am ET on October 30 out of an abundance of caution. The outage affected its Online Portal Now, Sageworks Analyst, and Sageworks API services, and continued through the weekend.
Abrigo provides cloud-based software and analytics to community banks and credit unions across the United States. Its Sageworks platform handles sensitive banking customer data, helping lenders process loan applications, assess creditworthiness, and monitor portfolios.
Abrigo said in updates over the weekend that its investigation was ongoing, but did not disclose details about the nature of the incident. In its latest update, the company said most Sageworks functionality had been restored, with the exception of borrower-facing features. Abrigo did not respond to queries before publication. Some cybersecurity researchers have advised banks and credit unions using Abrigo’s solutions to rotate their API keys.
The incident follows a claim earlier this year by an individual allegedly associated with the ShinyHunters extortion group, who said they had stolen 1.7 million Salesforce records from Abrigo containing names, email addresses, and account data.
Analysis
Why This Matters
- The outage and potential breach directly impacts thousands of small and mid-sized banks and credit unions that rely on Sageworks for loan processing.
- Sageworks handles sensitive financial data; a confirmed breach could expose borrowers' personal and financial information.
- The incident highlights the systemic risk posed by third-party software providers to the US financial sector.
Background
Abrigo is a cloud-based software provider for community banks and credit unions. Its Sageworks platform is used widely for loan origination, credit analysis, and portfolio monitoring. The company previously faced a claimed data breach earlier this year by the ShinyHunters group.
Key Perspectives
- Abrigo: stated it detected 'irregular activity' and disabled the system out of caution. It has confirmed the investigation is ongoing and that most services except borrower-facing ones have been restored. It has not commented on the nature of the incident.
- Cybersecurity researchers: have urged financial institutions to rotate API keys for the Sageworks platform as a precautionary step in case of a compromise.
What to Watch
- Whether Abrigo confirms a data breach and what data was exposed.
- Regulatory scrutiny from banking authorities (e.g., OCC, FDIC) regarding the incident and service restoration.
- The timeline for restoring borrower-facing features.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedAbrigo restored most Sageworks functionality, except for borrower-facing features.BleepingComputer: “In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features.”
- SupportedBleepingComputer described the incident as a suspected cyberattack.BleepingComputer: “Fintech platform Sageworks taken offline after suspected cyberattack.”
- SupportedBorrower-facing features remained unavailable.BleepingComputer: “In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features.”
- SupportedThe outage continued through the weekend.BleepingComputer: “On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.”
- SupportedAbrigo took Sageworks offline on October 30 to investigate suspicious activity.BleepingComputer: “On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.”
- SupportedAbrigo said it disabled the application at approximately 11:25 am ET out of caution.BleepingComputer: ““We identified irregular activity in our environment, and, out of abundance of caution, we disabled the Sageworks application at approximately 11:25 am ET,” the company said on Friday.”
- SupportedThe outage affected Online Portal Now, Sageworks Analyst and Sageworks API.BleepingComputer: “The incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.”
- SupportedAbrigo said it serves more than 2,400 entities across the United States.BleepingComputer: “According to the company, it serves more than 2,400 entities .”
- SupportedAbrigo said its investigation was ongoing and did not disclose details about the incident’s nature.BleepingComputer: “In status updates over the weekend, Abrigo said its investigation was ongoing but did not disclose details about the nature of the incident.”
- SupportedAbrigo did not respond to queries before publication.BleepingComputer: “BleepingComputer reached out to Abrigo for more details, but we have not received a response by publication time.”
- SupportedSome cybersecurity researchers advised banks and credit unions using Abrigo solutions to rotate API keys.BleepingComputer: “Although a data breach has not been confirmed, some cybersecurity researchers advised banks and credit unions using Abrigo's solutions to rotate the API keys for the Sageworks platform.”
- SupportedAn individual allegedly associated with ShinyHunters claimed to have stolen 1.7 million Salesforce records from Abrigo earlier in the year.BleepingComputer: “Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.”
