bleepingcomputer.comarticleFintech platform Sageworks taken offline after suspected cyberattack
Abrigo took its Sageworks lending and risk platform offline on 30 October 2026 after detecting "irregular activity", and has restored most functions except borrower-facing features. Sageworks serves over 2,400 US community banks and credit unions. Earlier in 2026 an alleged ShinyHunters member claimed theft of 1.7 million Salesforce records from Abrigo, and researchers advised customers to rotate Sageworks API keys. Abrigo has not said whether this was a breach.
TL;DR Abrigo disabled its Sageworks banking software after suspicious activity, restored most of it, and has not confirmed a breach.
Organisations named here
- Abrigo
Technologies named here
- Salesforce
- Online Portal Now (Abrigo)
- Sageworks
- Sageworks Analyst (Abrigo)
- Sageworks API (Abrigo)
Threat actors named here
- ShinyHunters
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup