Sageworks: Abrigo takes platform offline after 'irregular activity'; cause not disclosed
Severity: medium · Patch status: no-fix-needed · Since 2026-10-30
Abrigo, a fintech software company, took its Sageworks platform offline on 30 October 2026 after its status page reported that it had "identified irregular activity in our environment" and had disabled the application at about 11:25 am ET. The outage hit Sageworks Analyst, Online Portal Now and the Sageworks API. On 2 November 2026 Abrigo said most Sageworks functionality was back, but borrower-facing features remained offline. Abrigo has not said whether the cause was an attack, a breach or a technical fault, and has not disclosed any data exposure, a root cause or how many customers were affected. The 2,400+ figure is the number of entities Abrigo says it serves, not a count of affected customers. A separate April 2026 extortion claim against Abrigo, attributed to ShinyHunters, is recorded at abrigo-data-breach; no source reviewed for this record links it to the October outage. Precautionary steps are to rotate Sageworks API keys (advice from unnamed researchers, not from Abrigo), watch loan and borrower data for unusual activity, and check restored services before resuming borrower-facing workflows.
What to do
- Rotate API keys for the Sageworks platform
- Monitor for unusual activity in loan and borrower data
- Review exposure of banking customer data handled via Sageworks
- Follow Abrigo status updates and validate restored services before resuming borrower-facing workflows
Sources
All live incidents on Threat Watch
