Abrigo restores most Sageworks services after suspected cyberattack
Abrigo took its Sageworks lending platform offline on October 30 after detecting irregular activity in its systems, affecting Online Portal Now, Sageworks Analyst, and Sageworks API. The company has since restored most functionality, though borrower-facing features remain unavailable, and it has not disclosed whether the incident involved a data breach.
GoKawiil's interpretation of the reporting above, not reported fact.
Sageworks is used by over 2,400 banks and credit unions to process loans and assess borrower creditworthiness, meaning any compromise could expose sensitive financial data across the industry. The incident follows an earlier claim this year by the ShinyHunters extortion group of stealing 1.7 million Salesforce records from Abrigo, which could suggest the company remains a recurring target, though a link between the two incidents has not been confirmed.
- Abrigo disabled its Sageworks platform on October 30 after detecting suspicious activity.
- Most services have been restored, but borrower-facing features are still down.
- The company has not confirmed whether the outage stemmed from a breach or technical fault, following an earlier alleged attack by ShinyHunters.
YubiKey 5 Series Security Key — Incidents like the Sageworks outage highlight how critical strong access controls are for financial platforms handling sensitive data. A hardware security key like the YubiKey 5 adds robust multi-factor authentication to protect accounts from unauthorized access and credential-based attacks. It's a practical step for both businesses and individuals looking to harden their login security against the kind of irregular activity that led to this outage.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-02
Published there as: “Fintech platform Sageworks taken offline after suspected cyberattack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.