Financial technology company Abrigo has restored most of its Sageworks risk management application after taking the platform offline because of suspected suspicious activity. Borrower-facing functionality remains unavailable, and the company has not yet determined whether the incident involved a data breach or a technical issue.
Sageworks outage followed suspicious activity
Abrigo began emergency maintenance on October 30 after detecting what it described as “irregular activity” in its environment. The company disabled the Sageworks application at approximately 11:25 a.m. ET while it investigated the activity, leaving the service unavailable through the weekend.
“We observed irregular activity in our environment and out of an abundance of caution, we disabled the Sageworks application at approximately 11:25 a.m. ET,” Abrigo said Friday.
In a weekend situation update, Abrigo said its investigation was ongoing but did not disclose the nature of the incident. The outage affected Online Portal Now, Sageworks Analyst and Sageworks API services.
Most functionality restored
In its latest update, Abrigo said that most Sageworks functionality had been restored. Features used by borrowers, however, remain unavailable.
Abrigo provides cloud-based software and analytics solutions to community banks and credit unions across the United States. The company says it serves more than 2,400 entities.
Its Sageworks software platform helps lenders process loan applications, analyze borrowers’ finances, assess creditworthiness and monitor loan portfolios. Because of those functions, the platform handles sensitive information, including bank customer details.
BleepingComputer contacted Abrigo for additional information but had not received a response by the time of publication. Until the company clarifies the nature of the activity, it remains unclear whether the outage resulted from a breach or a technical problem.
Earlier claims involving Abrigo
Earlier this year, an alleged member of the ShinyHunters extortion group claimed that the group had attacked Abrigo and stolen 1.7 million Salesforce records containing personally identifiable information and internal company data.
The attackers claimed the stolen information included names, email addresses, phone numbers, employee data and account data. No data breach connected to that incident or the Sageworks outage has been confirmed.
Despite the lack of confirmed breaches, some cybersecurity researchers have advised banks and credit unions that use Abrigo’s solutions to rotate their Sageworks API keys.
Source: www.bleepingcomputer.com