Financial technology company Abrigo has restored most of its Sageworks risk management application after taking the platform offline to investigate suspicious activity. Borrower-facing capabilities remain unavailable.
Abrigo began emergency maintenance on October 30 after detecting irregular activity in its environment earlier that day. The company disabled Sageworks at approximately 11:25 a.m. ET, and the outage continued through the weekend.
The incident affected Online Portal Now, Sageworks Analyst, and the Sageworks API. In its latest status update, Abrigo said that most Sageworks functionality had returned, excluding features used by borrowers.
Abrigo provides cloud-based software and analytics services to community banks and credit unions in the United States, serving more than 2,400 organizations, according to the company. Sageworks helps lenders process loan applications, evaluate borrowers’ finances and creditworthiness, and monitor loan portfolios. The platform therefore handles sensitive banking customer information.
Abrigo said its investigation was still underway but has not disclosed the nature of the activity or confirmed whether customer data was accessed. Until more information is released, it remains unclear whether the outage resulted from a security breach or a technical problem.
Earlier this year, an individual allegedly associated with the ShinyHunters extortion group claimed to have attacked Abrigo and stolen 1.7 million Salesforce records containing personally identifiable information and internal corporate data. The claims included the alleged theft of names, email addresses, phone numbers, employee information, and account data, but no breach has been confirmed.
Some cybersecurity researchers advised banks and credit unions using Abrigo’s services to rotate their Sageworks API keys. Abrigo had not provided additional details by the time of publication.
Sources: BleepingComputer.