A Sageworks outage disrupted lenders after Abrigo detected irregular activity and took the platform offline on October 30. By November 2, the company had restored most functions, although borrower-facing features remained unavailable.
Abrigo shuts down platform to investigate
Abrigo disabled Sageworks at approximately 11:25 a.m. Eastern Time on Friday after identifying suspicious activity in its environment. The company described the shutdown as a precaution and began emergency maintenance. However, the interruption continued throughout the weekend as its investigation progressed.
The disruption affected Online Portal Now, Sageworks Analyst and the Sageworks API. During the weekend, Abrigo published status updates confirming that investigators were still examining the incident. Nevertheless, it did not explain what triggered the suspicious activity or identify a specific attack method.
In its November 2 update, Abrigo said it had restored most of the application’s functionality. Borrower-facing capabilities remained the exception. Consequently, the announcement marked a partial recovery rather than a complete return to normal service.
Sageworks outage affects lending software
Abrigo supplies cloud-based software and analytics to community banks and credit unions across the United States. The company says it serves more than 2,400 organisations. Its products support financial institutions with lending and risk management tasks.
Sageworks helps lenders process applications, analyse borrowers’ finances and assess their creditworthiness. In addition, financial institutions use it to monitor loan portfolios. These activities involve sensitive information, including banking customer details, making the investigation relevant to institutions that rely on the platform.
However, Abrigo has not confirmed that anyone accessed or stole customer information during this incident. The available updates also do not establish whether a security breach or a technical problem caused the disruption. Therefore, the suspected cyberattack remains unconfirmed.
Earlier data theft claim remains separate
Earlier in 2026, someone claiming an association with the ShinyHunters extortion group alleged that they had attacked Abrigo. The individual claimed to have stolen 1.7 million Salesforce records containing personal information and internal corporate data. According to that claim, the records included names, email addresses, telephone numbers, employee information and account data.
However, the supplied information does not establish a connection between that allegation and the current Sageworks outage. The earlier claim also does not confirm what happened during the October 30 incident. Abrigo’s latest public updates leave the cause and potential data impact unresolved.
Meanwhile, some cybersecurity researchers have advised banks and credit unions using Sageworks to rotate their API keys as a precaution. That advice does not indicate that investigators have confirmed compromised credentials. For now, Abrigo has reported substantial service restoration while its investigation continues.
0 responses to “Sageworks outage follows suspected cyberattack”