Abrigo shut down its Sageworks lending platform on Oct. 30 after detecting suspicious activity in its systems. In a Nov. 2 status update, Abrigo said the platform was available again except for borrower-facing capabilities.
Sageworks supports lending and credit analysis for U.S. banks and credit unions. The shutdown affected Sageworks Analyst, Sageworks API, and Online Portal Now, which provides borrowers access to online lending services. Abrigo has not confirmed a cyberattack or data breach, and the number of affected institutions remains unknown. Banks now need to verify that their systems are working, review applications handled during the outage, and confirm when customers can safely resume using the platform.
Abrigo shut down Sageworks while investigating irregular activity
BleepingComputer reported that Abrigo detected irregular activity on Oct. 30 and disabled Sageworks around 11:25 a.m. ET. The shutdown continued through the weekend.
Abrigo status updates captured by monitoring service IsDown document the investigation and the Nov. 2 announcement that the platform was available again except for borrower-facing capabilities. The latest update independently verified for this report was dated Nov. 2.
Ross Filipek, CISO at Corsica Technologies, said the shutdown suggests Abrigo considered continued operation too risky while investigating. However, the decision does not establish what caused the unusual activity.
“Disabling a compromised account is one thing. Stopping a service customers depend on carries a different cost,” Filipek said.
Abrigo has not publicly established whether attackers accessed its systems or customer data. Its decision to stop services should not be mistaken for proof of a breach.
A restored lending platform can still leave borrowers waiting
Sageworks supports loan origination, credit analysis, and portfolio risk monitoring. Abrigo’s developer documentation describes how financial institutions can use API credentials to register borrowers, obtain login tokens, and launch online portal sessions.
If those features remain unavailable, borrowers may be unable to complete applications online, while loan officers must track submissions through approved alternative channels. Applications received during the interruption may also need reconciliation when systems return.
Filipek warned that interrupted lending processes could leave backlogs beyond the outage. He urged institutions to verify financial-data integrity and provide customers with clear instructions for safe alternatives.
Abrigo says it serves more than 2,400 financial institutions, but that company-wide figure does not indicate how many experienced disruption.
Banks need more than a restored service notification
Before returning to routine processing, bank security, lending, and vendor-management teams should assess their ability to recover from operational disruptions, starting with three checks:
- Test the full borrower journey. Verify portal access, application submissions, and acknowledgments. Reconcile pending requests against manually collected forms, then tell applicants which channels they can safely use.
- Review integrations and records. Check API logs, access scopes, and transaction histories. Abrigo's API guidance explains how institutions manage client credentials. Coordinate any precautionary rotation with the vendor, as credential theft has not been confirmed.
- Confirm the recovery and reporting plan. Ask Abrigo which services are fully restored, whether data integrity checks are complete, and how institutions will receive updates. Federal banking guidance emphasizes oversight of critical service providers and continuity planning.
Under federal incident-notification rules, covered banking organizations must notify their primary federal regulator as soon as possible, and no later than 36 hours after determining that a qualifying notification incident occurred. Covered service providers must notify affected bank customers as soon as possible after determining that a computer-security incident has materially disrupted or degraded—or is reasonably likely to materially disrupt or degrade—covered services for four or more hours. Whether those thresholds were met here has not been established.
“The pressure to restore services shouldn’t outweigh the need to ensure the integrity of the platform,” Filipek said.
A bank should be able to tell an applicant whether a loan request was received, whether it needs to be resubmitted, and when online processing is safe again. Until staff can answer those questions, Abrigo's restoration notice is only part of the recovery.
Also read: Group-IB researchers uncovered how hackers exploited open-banking services to test stolen bank logins for free, raising concerns about credential abuse and the security of financial platforms.