--- title: Fintech platform Sageworks taken offline after suspected... description: Abrigo took its Sageworks risk management application offline on October 30 after detecting 'irregular activity' in its environment. Sageworks helps lenders... canonical: https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fintech platform Sageworks taken offline after suspected cyberattack | daily.dev og:description: Abrigo took its Sageworks risk management application offline on October 30 after detecting 'irregular activity' in its environment. Sageworks helps lenders... og:url: https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr og:image: https://api.daily.dev/og/posts/IeVznoryR.png og:image:alt: Fintech platform Sageworks taken offline after suspected cyberattack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fintech platform Sageworks taken offline after suspected cyberattack **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary Abrigo took its Sageworks risk management application offline on October 30 after detecting 'irregular activity' in its environment. Sageworks helps lenders process loan applications and assess borrower creditworthiness, and handles sensitive banking customer data. The outage affected Online Portal Now, Sageworks Analyst, and Sageworks API. Most functionality has since been restored except borrower-facing features. Abrigo serves more than 2,400 entities and hasn't disclosed whether this is a breach. Earlier this year, someone allegedly part of the ShinyHunters group claimed they stole 1.7 million Salesforce records with personal and corporate data from Abrigo, though a data breach has not been confirmed; some researchers advised rotating Sageworks API keys. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is Abrigo's Sageworks platform down right now? Abrigo disabled the Sageworks application on October 30 at approximately 11:25 am ET after identifying 'irregular activity' in its environment, as a precaution. The outage affected Online Portal Now, Sageworks Analyst, and the Sageworks API. Most functionality has since been restored except borrower-facing features, and Abrigo has not disclosed whether the incident involved a data breach. _Banks relying on Abrigo's Sageworks can track incident updates and vendor outages like this on daily.dev._ ### Was Abrigo hit by a data breach involving Salesforce records? A breach has not been confirmed, but someone claiming to be part of the ShinyHunters extortion group alleged earlier this year that they stole 1.7 million Salesforce records from Abrigo, including full names, email addresses, phone numbers, and employee and account data. Some cybersecurity researchers advised banks and credit unions using Abrigo's solutions to rotate their Sageworks API keys as a precaution. _Teams assessing third-party vendor risk after alleged breaches follow incidents like this on daily.dev._ ## Similar posts on daily.dev - [Bullhorn sees red after cyberattack knocks recruitment platform offline](https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6) · The Register · 0 upvotes · 0 comments - [Snowflake customers hit in data theft attacks after SaaS integrator breach](https://daily.dev/posts/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach-v9c1wyxhi) · BleepingComputer · 0 upvotes · 0 comments - [What the Recent PayPal Breach Says About Modern Web Risk](https://daily.dev/posts/what-the-recent-paypal-breach-says-about-modern-web-risk-uhz6thlec) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#fintech](https://daily.dev/tags/fintech), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fintech platform Sageworks taken offline after suspected cyberattack","url":"https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr"},"datePublished":"2026-11-02T19:04:13.557Z","dateModified":"2026-11-02T19:07:21.138Z","description":"Abrigo took its Sageworks risk management application offline on October 30 after detecting 'irregular activity' in its environment. Sageworks helps lenders...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9d0500bac870e39aec316b30bef48213?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9d0500bac870e39aec316b30bef48213?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,fintech,data-breach","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Fintech platform Sageworks taken offline after suspected cyberattack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack-ievznoryr#faq","mainEntity":[{"@type":"Question","name":"Why is Abrigo's Sageworks platform down right now?","acceptedAnswer":{"@type":"Answer","text":"Abrigo disabled the Sageworks application on October 30 at approximately 11:25 am ET after identifying 'irregular activity' in its environment, as a precaution. The outage affected Online Portal Now, Sageworks Analyst, and the Sageworks API. Most functionality has since been restored except borrower-facing features, and Abrigo has not disclosed whether the incident involved a data breach. Banks relying on Abrigo's Sageworks can track incident updates and vendor outages like this on daily.dev."}},{"@type":"Question","name":"Was Abrigo hit by a data breach involving Salesforce records?","acceptedAnswer":{"@type":"Answer","text":"A breach has not been confirmed, but someone claiming to be part of the ShinyHunters extortion group alleged earlier this year that they stole 1.7 million Salesforce records from Abrigo, including full names, email addresses, phone numbers, and employee and account data. Some cybersecurity researchers advised banks and credit unions using Abrigo's solutions to rotate their Sageworks API keys as a precaution. Teams assessing third-party vendor risk after alleged breaches follow incidents like this on daily.dev."}}]} ```