Abrigo, a software vendor to US banks and credit unions, disabled its Sageworks lending platform on 30 October 2026 after detecting irregular activity, then confirmed a data security incident. Most of the service returned on 2 November, but borrower-facing features were still listed as unavailable on 5 November.
What happened
- 30 October, the shutdown. Abrigo's status page first described emergency maintenance at 10:58 ET, then said the Sageworks application had been disabled at about 11:25 ET after "irregular activity in our environment". The incident covered Sageworks Analyst, the Sageworks API and Online Portal Now, the portal borrowers use for loan applications.
- 2 November, partial return. At 07:11 ET the status page said the platform was available except for borrower-facing capabilities. That evening a spokesperson told American Banker the company was investigating a data security incident with third-party specialists, that the unauthorized access "has been contained", and that it had no evidence of continued access.
- 3 November, a separate listing. Abrigo opened a separate incident for borrower-facing functionality, then marked the original one resolved.
- 5 November, still open. The latest update, at 14:16 ET, said Abrigo was continuing to monitor. Online Portal Now showed a partial outage, while Sageworks Analyst and the Sageworks API showed as operational.
What is not known. American Banker reports that Abrigo did not say whether data was accessed or taken, and did not say how many institutions use Sageworks. Abrigo's website says more than 2,400 institutions use its products overall. The cause has not been published.
Earlier incidents are not an established link. American Banker describes an August 2025 intrusion through a Salesforce connection to Drift, and, citing Have I Been Pwned, an April 2026 extortion attempt by ShinyHunters. BleepingComputer reports an alleged claim of 1.7 million stolen Salesforce records. Abrigo did not answer American Banker's question about whether the Sageworks incident is related.
Key rotation advice is unattributed. BleepingComputer and Teiss report that unnamed researchers advised customers to rotate Sageworks API keys. eSecurity Planet advises coordinating any rotation with the vendor, because credential theft has not been confirmed.
What it means for businesses
Three points apply to any company that runs on hosted software.
The customer-facing part can return last. Bank staff had most of the service back in under three days. Borrower-facing features were still listed as unavailable six days after the shutdown. Abrigo has not said why they are taking longer, but check whether your continuity plan covers the channel your customers use.
Taking a system offline can be the right call, and you still need a plan for it. Abrigo described its shutdown as a precaution. Whatever the cause, customers lost the platform from late Friday morning through the weekend.
Notification rules set a floor, not a plan. US banking rules require a bank service provider to notify at least one designated contact at each affected customer as soon as possible after determining that an incident has materially disrupted or degraded, or is reasonably likely to disrupt or degrade, covered services for four or more hours. A bank must tell its regulator no later than 36 hours after determining that a notification incident has occurred. eSecurity Planet says it has not been established whether those thresholds were met here. American Banker adds that credit unions fall under a separate 72-hour rule. Companies elsewhere depend on their own contracts and local law.
What to do next
- List the hosted systems your customers touch, such as portals, booking pages, payment pages and application forms. Name an owner for each one.
- Write and test a manual fallback. Decide how you would take an application, an order or a payment if that system disappeared for a week.
- Inventory your API keys and integrations. Record which system holds each key, what it can reach and how to rotate it without breaking a live process. If a vendor has an open incident, coordinate any rotation with them.
- Check who receives vendor notices. Abrigo's status page said notices were going to all Product and IT & Security contacts at each customer. A contact who has left can mean a missed warning.
- Review your contract terms. A software service level agreement should cover severity levels, response times and incident notice. Also ask what the vendor will tell you about affected data and logs.
- Keep your own copy of critical data. Confirm that you can export it on a schedule, and that someone has opened a recent export.
- Reconcile after any restoration. eSecurity Planet suggests testing the full borrower journey, reconciling pending applications and reviewing API logs and access scopes.
Companies that build their own financial products can use our fintech app security checklist as a starting point for access control and logging.
Timeline Digital, a custom software development company founded in 2013 in Islamabad, builds and supports business software as managed projects, including fintech software. Every project starts with a free pilot: Before you commit to the full project, we build 2 to 3 of your key modules as working software, free of charge, ready in about 2 days. Your team tests the pilot, and the full build starts only after you approve it.
Sources
- Abrigo system status, Abrigo, entries from 30 October to 5 November 2026
- Abrigo confirms 'data security incident' caused 3-day outage, American Banker, 3 November 2026
- Fintech platform Sageworks taken offline after suspected cyberattack, BleepingComputer, 2 November 2026
- Abrigo Sageworks Shutdown: Recovery Checks for Banks, eSecurity Planet, 3 November 2026
- Abrigo restores most of Sageworks after outage over suspicious activity; borrower features still offline, Teiss, 3 November 2026
- Computer-Security Incident Notification Final Rule (FIL-74-2021), FDIC, November 2021