- Abrigo shut down its Sageworks lending software on Oct. 30 after spotting “irregular activity.” Most services were back by Monday, Nov. 2.
- Tools for borrowers were still offline at last report. The company has not said whether hackers caused the outage or took any data.
- Some researchers told banks and credit unions to swap their Sageworks API keys as a safety step.
Abrigo spent the weekend with its Sageworks lending platform offline. The company serves community banks and credit unions across the country. It pulled Sageworks down on Friday, Oct. 30, at about 11:25 a.m.
Eastern. Staff had spotted odd activity earlier that day. By Monday, most features worked again. Even so, the company has not explained what happened.
Irregular Activity Discovered in Sageworks’ Systems
So far, the company has shared very little. Its statement said staff found irregular activity in its systems. It then shut off the app as a safety step and began emergency maintenance. Over the weekend, the company posted status updates. However, those updates only said the probe was still going. They gave no details about the cause.
The outage hit three services. These were Online Portal Now, Sageworks Analyst, and the Sageworks API. On Monday, the company reported that most functions had returned. Features that borrowers use were still down. But there’s been no newer public update as of Tuesday, Nov. 3.
What Makes Sageworks a Top Target for Cybercriminals
The company says it serves more than 2,400 entities, including community banks and credit unions across the United States. Lenders use the software to process loan requests. They also study a borrower’s money, judge credit risk, and track loans they already hold.
Because of that work, the system holds private data about bank customers. An outage can therefore slow down key tasks. For a small bank, that could mean waiting on loan decisions.
The firm started out as Sageworks in Raleigh, North Carolina, in 1998. It later took the Abrigo name. The Sageworks name now covers one of its products.
Nevertheless, it has not been verified whether the recent event was a cyberattack or not. It still remains unclear whether the company experienced a breach or a glitch in its technology systems, and this detail will provide some additional information about the situation. Firms sometimes pull systems offline as a safety move, then find no intruder. In other cases, the shutdown does follow a real attack.
A similar case involving uncertainty around system access emerged when Meta’s AI model breached company systems during a security test after a setup error, highlighting how technical mistakes can expose internal systems.
The wording offers a hint, but no proof. The company only said it acted “out of abundance of caution.” That phrase points to a safety move. It does not rule out an attack, though. Right now, the public cannot tell which one this is.
An Earlier Hacking Claim Against Abrigo
Earlier this year, someone linked to the ShinyHunters extortion group claimed an attack on Abrigo. Trackers that watch criminal leak sites logged the claim on April 12. The poster said the group took 1.7 million Salesforce records. The post set an April 14 deadline for contact. Otherwise, the poster threatened to leak the data.
According to the claim, the records held names, email addresses, and phone numbers. They also included employee and account data. The same group has claimed other Salesforce data thefts.
The company has not confirmed any of this. In addition, nothing published so far links the claim to this outage. The claim also described Salesforce records, not Sageworks loan files. Two events in the same year do not prove a link.
Not Abrigo’s First Time Experiencing an Outage
Sageworks has gone down before. In those cases, though, the company named a cause.
On Oct. 20, 2025, a global Amazon Web Services outage knocked Sageworks offline. Service came back by that evening. In July 2024, a faulty CrowdStrike software update disrupted its systems. The company pointed to that update in its own incident report.
Another issue hit about six weeks ago. Sageworks experienced a login service outage on September 21, 2026. There was a problem with new logins on several products such as Sageworks Analyst and Sageworks API. The company later traced leftover problems to a September software update.
This time, it has no cause. That silence is the main reason questions keep piling up.
Some experts recommended that banks and credit unions rotate their Sageworks API keys. For context, an API key is something like a password that allows programs to communicate with each other. Rotating these keys entails changing old ones with new ones. As a result, any stolen key stops working.
This advice is a precaution. No breach has been confirmed. Still, the Sageworks API was one of the three services hit by the outage.
What’s Next?
Three answers will show how serious this is. First, the company needs to say when borrower tools will return. Second, it needs to explain what the odd activity was. Finally, it needs to say whether anyone gained access to customer data.
Until then, banks and credit unions must work with few facts. Their security teams can review the researchers’ advice on API keys. Meanwhile, customers who have questions can ask their own lender directly. Banks should also watch for any notice from the company about customer data.
