Threat watch / Attack
Abrigo: Sageworks lending platform for banks shut down after unauthorized access
Abrigo, a US software provider for banks and credit unions, disabled its Sageworks lending platform on October 30 after spotting "irregular activity in our environment". It later confirmed a "data security incident" and said the unauthorized access had been contained. Most of the platform came back on November 2; borrower-facing features stayed down. Abrigo has not said whether any data was taken.
- Sector
- Finance
- Way in
- Not public yet
- Product or vendor
- Abrigo Sageworks
- How it happened
- Not public yet Checked 9 Nov 2026
- What was stolen
- Not public yet Checked 9 Nov 2026
- Who was impacted
- Banks and credit unions using Sageworks Analyst, the Sageworks API and the Online Portal Now borrower portal, which were taken offline. Abrigo says it serves more than 2,400 institutions across all its products; it has not said how many use Sageworks or were affected.[1][2] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- Abrigo's status page reports emergency maintenance, then says Sageworks was disabled just before 11:30 a.m. ET after the company identified "irregular activity in our environment". [1]
- Most of Sageworks is available again, except borrower-facing capabilities. An Abrigo spokesperson confirms "a recent data security incident related to our Sageworks platform", investigated with third-party specialists, and says the unauthorized access has been contained. [1][2]
- The status page still lists the incident as unresolved. Abrigo has not said how the attackers got in, whether data left its systems or how many institutions were affected. American Banker notes it is the company's third security incident in about 14 months. [1][2]