INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Sageworks taken offline via suspected cyberattack by unknown actors

| 2026-11-02 19:00 CRITICAL LOW DATA BREACH DDOS & DISRUPTION
JSON
Executive Summary
AI-generated
On November 2, 2026, Abrigo's Sageworks risk management application was taken offline following "irregular activity" detected in its environment. The company serves over 2,400 entities across the United States and provides cloud-based software and analytics solutions for community banks and credit unions. An alleged attack by ShinyHunters extortion group earlier this year claimed they stole 1.7 million Salesforce records containing personally identifiable information and internal corporate data. Although a data breach has not been confirmed, cybersecurity researchers advised Abrigo's users to rotate API keys for the Sageworks platform. The incident impacted borrower-facing features of the application, with most functionality restored except for these services. Adaptive Security's AI agents analyzed email intent to uncover phishing and business email compromise threats during this time.
Technical Mitigations AI-generated
• Rotate API keys for the Sageworks platform to prevent unauthorized access. • Use Adaptive Security's AI agents to analyze email intent, context, and behavior to uncover phishing attempts. • Block or hunt for suspicious activity detected in Abrigo's environment.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
US
financefinance technologytechnology
Incident Timeline
‎October 30
On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.
‎2026/11/02
Abrigo's Sageworks risk management application was taken offline after suspected irregular activity in its environment.
threat_actor ShinyHunters
Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.
data_breach 1.7 Salesforce records
Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.
organisation Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Abrigo
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.
organisation Sageworks
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.
‎2026/11/02
In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features.
Tactical Metrics
Metrics
data_breach
1,700,000
Salesforce Records
Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Intelligence Sources
BleepingComputer 2026-11-02