Abrigo Partially Restores Sageworks Platform After Suspected Cyberattack

Abrigo has begun restoring functionality to its Sageworks risk management application following an outage triggered by “irregular activity” detected within its environment.

The fintech provider initiated emergency maintenance and took the platform offline on 30 October 2026. While most core services have been reinstated, borrower-facing capabilities remain unavailable.

Affected Services and Impact

The incident impacted several critical components, including the Sageworks Analyst, the Online Portal, and the Sageworks API.

Sageworks is a cloud-based software and analytics solution used by more than 2,400 community banks and credit unions across the United States. The platform is integral to the lending process, helping institutions assess creditworthiness, analyse borrower finances, and monitor loan portfolios. Due to its function, the software processes highly sensitive banking customer details and personally identifiable information (PII).

Abrigo has not yet disclosed the specific nature of the incident or confirmed whether a data breach occurred.

Previous Security Claims

This development follows an earlier claim by the ShinyHunters extortion group, which alleged it had exfiltrated 1.7 million Salesforce records containing employee and account data from the company. That claim involved various internal corporate data, including names, email addresses, and phone numbers, though a full breach was not confirmed at that time.

As a precautionary measure, some cybersecurity researchers have advised banks and credit unions using the Sageworks platform to rotate their API keys.