Fintech platform Sageworks taken offline after suspected cyberattack

Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.

On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.

Abrigo provides cloud-based software and analytics solutions for community banks and credit unions across the United States. According to the company, it serves more than 2,400 entities.

Its Sageworks product is a software platform that helps lenders process loan applications, analyze borrowers’ finances, assess creditworthiness, and monitor loan portfolios.

Due to its nature, Sageworks handles sensitive information, including banking customer details.

"We identified irregular activity in our environment, and, out of abundance of caution, we disabled the Sageworks application at approximately 11:25 am ET," the company said on Friday.

In status updates over the weekend, Abrigo said its investigation was ongoing but did not disclose details about the nature of the incident.

The incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.

In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features.

BleepingComputer reached out to Abrigo for more details, but we have not received a response by publication time. Until the nature of the incident is disclosed, it is unclear if the outage was caused by a breach or a technical issue.

Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.

The threat actor said at the time that they exfiltrated full names, email addresses, phone numbers, employee and account data.

Although a data breach has not been confirmed, some cybersecurity researchers advised banks and credit unions using Abrigo's solutions to rotate the API keys for the Sageworks platform.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.