Sageworks restored after outage linked to suspicious activity

Financial technology company Abrigo has restored most functions of its Sageworks risk management application after taking it offline to investigate suspicious activity. Borrower-facing features remain unavailable.

Abrigo said it began emergency maintenance on October 30, after detecting what it called “irregular activity” in its environment. The company disabled Sageworks at approximately 11:25 am ET, and the outage continued through the weekend. The disruption affected Online Portal Now, Sageworks Analyst, and Sageworks API.

Abrigo provides cloud-based software and analytics to community banks and credit unions in the United States. It says it serves more than 2,400 entities. Sageworks helps lenders process loan applications, analyze borrowers’ finances, assess creditworthiness, and monitor loan portfolios.

The company has not disclosed the nature of the incident. BleepingComputer said it had contacted Abrigo for more information but had not received a response by publication time. It remains unclear whether the outage resulted from a breach or a technical issue.

Earlier this year, a person allegedly affiliated with the ShinyHunters extortion group claimed to have attacked Abrigo and stolen 1.7 million Salesforce records containing personal information and internal corporate data. Abrigo has not confirmed a data breach. Some cybersecurity researchers advised banks and credit unions using its services to rotate Sageworks API keys.