Abrigo Restores Most Sageworks Services After Suspicious-Activity Outage
Summary
Abrigo took Sageworks offline on October 30 after detecting irregular activity. Most services have been restored, but borrower-facing features remain unavailable; the company has not disclosed the incident’s nature, and a breach is unconfirmed.
Key points
- Abrigo said it detected irregular activity on October 30 and disabled Sageworks while investigating.
- The outage affected Online Portal Now, Sageworks Analyst, and Sageworks API.
- Most Sageworks functionality has been restored, except for borrower-facing capabilities.
- Abrigo has not disclosed whether the incident involved a breach or a technical issue.
- Separately, a person allegedly affiliated with ShinyHunters previously claimed theft of 1.7 million Salesforce records from Abrigo; the breach was not confirmed.
- Researchers advised banks and credit unions using Abrigo solutions to rotate Sageworks API keys.
Article Details
- Victim Organization
- Abrigo
- Incident Type
- Suspected cyberattack or technical issue; the cause of the outage was not disclosed.
- Incident Date
- 2026-10-30
- Disclosure Date
- 2026-10-30
- Data Types Exposed
- Full names, email addresses, phone numbers, employee and account data, and internal corporate data were claimed stolen in an earlier, unconfirmed attack; no data exposure was confirmed in connection with the October 30 outage.
- Affected Records
- An individual claimed that 1.7 million Salesforce records were stolen in an earlier, unconfirmed attack; the figure was not established as related to the October 30 outage.
- Operational Impact
- Abrigo took the Sageworks application offline for emergency maintenance after detecting irregular activity. Online Portal Now, Sageworks Analyst, and Sageworks API were impacted. Most functionality was restored by November 2, 2026, except borrower-facing features.
- Ransom Or Extortion
- A person allegedly associated with ShinyHunters claimed an earlier attack and data theft. No ransom demand was reported, and no link to the October 30 outage was established.
- Claim Status
- alleged
Threat Actors
Vendors
Products
Online Portal NowThe incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.SageworksFintech platform Sageworks taken offline after suspected cyberattackSageworks AnalystThe incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.Sageworks APIThe incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.