Abrigo confirms ‘data security incident’ caused 3-day outage

• Key insight: Abrigo confirmed to American Banker that the “irregular activity” behind its Sageworks shutdown was a data security incident involving unauthorized access, which it says has been contained.
• What’s at stake: Sageworks stores the documents behind commercial and small-business loan applications and existing loans, including borrowers’ tax returns and financial statements, and Abrigo did not say whether any data was taken.

Overview bullets generated by AI with editorial review.

Processing Content

Bank software vendor Abrigo confirmed Monday evening that a data security incident involving unauthorized access led it to pull its Sageworks lending platform offline through the weekend.

Abrigo, which sells lending, risk and anti-money-laundering software to community banks and credit unions, disabled Sageworks on Friday, Oct. 30, after spotting what it then called “irregular activity in our environment,” according to the company’s public status page.

A spokesperson for Abrigo told American Banker Monday evening that the company is investigating “a recent data security incident related to our Sageworks platform.”

Most of Sageworks came back Monday morning. The features that face borrowers, such as the online portal where they fill out loan applications, remained down, and the status page still listed the incident as unresolved as of Tuesday morning.

Banks and credit unions use Sageworks to analyze commercial and small-business loans. The platform also stores the documents behind those loans — both pending applications and loans already on the books.

The stored documents include borrowers’ “tax returns, financial statements, rent rolls, credit reports,” according to Abrigo’s product page for the software.

Abrigo did not say whether anyone accessed or took that data.

More than 2,400 institutions use Abrigo’s products, according to the company’s website. That figure covers all of its software, not Sageworks alone.

When the private equity firm Accel-KKR acquired Sageworks in 2018, a year before Sageworks combined with two other companies to form Abrigo, the product served “more than 1,200 U.S. banks and credit unions,” American Banker reported at the time.

The Sageworks shutdown marks the third security incident involving Abrigo in about 14 months. The first two exposed business contact information linked to Abrigo’s Salesforce database.

What Abrigo has said

Abrigo is investigating the Sageworks incident “with the support of third-party specialists,” according to the company spokesperson.

“Our investigation indicates that the unauthorized access has been contained, and we have no evidence of continued unauthorized access to the system,” the spokesperson said.

Abrigo did not answer questions about what data, if any, left its systems; how many institutions use Sageworks; whether its notices to customers were the incident notices that federal banking rules require of service providers; and whether the incident relates to the two earlier ones.

How the Sageworks shutdown unfolded

Abrigo first posted the shutdown on its status page on Friday, just before 11 a.m. Eastern time. The company said it was conducting “emergency maintenance” on Sageworks and apologizing “for the late notice.”

Just before 1:30 p.m. the same day, the status page gave a reason: “We identified irregular activity in our environment, and, out of abundance of caution, we disabled the Sageworks application” just before 11:30 a.m.

The same post said Abrigo was sending notices “to all Product and IT & Security contacts” at each customer institution. Later posts on the status page told customers to “check your email for more specific details.”

The incident hit three Sageworks services, according to the status page: Sageworks Analyst, which is an analytics dashboard for loan issuers; the Sageworks API, which banks’ other systems use to exchange data with Sageworks; and Online Portal Now, where borrowers fill out loan applications.

Shortly before 7:15 a.m. on Monday, Abrigo posted that the platform was “available, with the exception of borrower facing capabilities,” according to the status page.

Abrigo’s earlier incidents

In August 2025, attackers got into Abrigo’s Salesforce account, a customer-relationship database, through a compromised link between Salesforce and software from the chatbot company Drift.

The attackers targeted “institution name, employee name, email addresses, and phone numbers,” according to an August 2025 letter Abrigo’s chief information security officer sent to customers about the intrusion.

The intrusion was part of “a larger social engineering attack involving data from numerous companies,” the letter said.

In April 2026, the extortion group ShinyHunters targeted Abrigo in a “pay or leak” extortion attempt, according to the breach-notification service Have I Been Pwned.

Someone later published data allegedly taken from Abrigo’s Salesforce database. Have I Been Pwned cataloged more than 711,000 unique email addresses from it belonging to Abrigo staff and outside contacts.

Have I Been Pwned describes the April data as separate from the 2025 intrusion, though it lists the same kinds of contact information.

What vendors and banks owe regulators

Under a rule federal bank regulators adopted in 2021, a bank service provider must notify each affected bank “as soon as possible” once it determines that a computer-security incident has materially disrupted its services to that bank for four or more hours.

Each bank then has to decide whether the disruption amounts to a “notification incident” of its own, as the rule calls it.

The rule defines that as an incident that has materially disrupted, or is reasonably likely to materially disrupt, a bank’s ability to carry out its operations or to serve “a material portion of its customer base.”

The rule leaves that call to each bank. If the answer is yes, the same rule gives the bank 36 hours to report the incident to its primary federal regulator.

The equivalent rule for credit unions is more burdensome; it requires notification not only for disruptions but also for “unauthorized access to sensitive data,” according to the rule text.

A credit union must report such an incident to the NCUA within 72 hours of hearing about it from the third party.

Abrigo did not provide copies of the emails it sent customers about the incident, which American Banker requested, so it is not clear whether they included the notice the federal rule requires.