VULNpocalypse
MediumEcosystem changeMonitoring

Sageworks taken offline after irregular activity, Abrigo says

Abrigo says irregular activity led it to take Sageworks offline; users should follow its status updates and consider rotating Sageworks API keys.

Published
Exploitation
No, not confirmed: Abrigo reports irregular activity but has not disclosed the nature of the incident

What happened

Abrigo says it identified “irregular activity” in its environment and disabled its Sageworks risk management application “out of abundance of caution,” according to BleepingComputer. BleepingComputer reports that on October 30 the company began emergency maintenance and took Sageworks offline to investigate suspicious activity detected earlier that day. The outage continued through the weekend.

According to BleepingComputer, Abrigo said in its latest update that most Sageworks functionality has been restored. Borrower-facing features remain unavailable. The affected services were Online Portal Now, Sageworks Analyst and Sageworks API.

The following is not confirmed:

  • Abrigo has not disclosed the nature of the incident.
  • BleepingComputer says it is unclear whether the outage was caused by a breach or a technical issue.
  • No data theft, entry point or attacker has been confirmed.
  • BleepingComputer reports it had not received a response from Abrigo by publication time.

Separately, BleepingComputer notes that earlier this year someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo. That person said they stole 1.7 million Salesforce records containing personally identifiable information and internal corporate data. The sources do not link that claim to the current outage.

Am I affected?

  • Who uses Sageworks: BleepingComputer reports that Abrigo provides cloud-based software and analytics to community banks and credit unions in the United States. It says it serves more than 2,400 entities (BleepingComputer).
  • Disrupted services: If your organization uses Online Portal Now, Sageworks Analyst or the Sageworks API, those services were disrupted.
  • Data exposure: BleepingComputer says Sageworks handles sensitive information, including banking customer details. Whether any data was exposed is not confirmed.

What to do now

  1. Follow Abrigo’s status updates for confirmation of the incident’s nature and for restoration of borrower-facing features.
  2. Consider rotating Sageworks API keys. BleepingComputer reports that some cybersecurity researchers advised banks and credit unions using Abrigo’s solutions to do this, although a data breach has not been confirmed (BleepingComputer).
  3. Contact Abrigo directly for details relevant to your organization’s account and integrations.

Sources