Short answer
Abrigo shut down its Sageworks platform on 30 October 2026 after spotting irregular activity, restored most of it by 3 November, and told American Banker it was investigating a data security incident. It says unauthorized access has been contained but has not said if data was taken.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Abrigo (Sageworks) |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Financial technology for community banks and credit unions |
| Country | United States |
| Detected | 2026-10-30 |
| Disclosed | 2026-10-30 |
| People or records affected | Not disclosed. Abrigo has not said whether data was accessed or how many institutions are affected |
What data was exposed
- Not confirmed. Abrigo has not said whether any data was accessed or taken
- Sageworks holds loan documents such as tax returns and financial statements, according to American Banker
What happened
Abrigo sells cloud software to community banks and credit unions. On 30 October 2026 it took its Sageworks application offline after what it called “irregular activity in our environment,” acting, it said on its status page, out of an abundance of caution. BleepingComputer reported the outage on 2 November and said it was unclear whether it was a breach or a technical fault.
By the morning of 3 November, Abrigo had restored most of Sageworks. That evening it told American Banker it was investigating “a recent data security incident related to our Sageworks platform.”
What Abrigo says
According to American Banker, an Abrigo spokesperson said: “Our investigation indicates that the unauthorized access has been contained,” and that the company had no evidence of continued unauthorized access. It is working with third-party specialists. Notices went to Product and IT and Security contacts at customer institutions, per its status page.
What is not known
Abrigo has not said whether any data was accessed or taken, how many institutions are affected, or how the access happened. American Banker reported that Abrigo did not provide copies of customer notices. The affected services were Online Portal Now, Sageworks Analyst and the Sageworks API. No threat group has claimed this incident in the sources we reviewed, so the status is “under investigation” and the data exposed field is left unconfirmed on purpose.
Earlier incidents
American Banker notes two earlier events involving Abrigo in the past 14 months: an August 2025 intrusion into its Salesforce account via a Drift integration, and an April 2026 pay-or-leak attempt by ShinyHunters, with Have I Been Pwned later counting more than 711,000 email addresses in published data. Abrigo has not said whether the Sageworks incident is connected.
What to do
Banks using Sageworks should watch for Abrigo’s direct communications and consider rotating API keys, as some researchers suggested per BleepingComputer. Borrowers should be wary of messages that mention an outage or ask for loan paperwork. Phishing tends to follow publicized outages.
See our data breach checklist, plus guides on phishing messages and bank transfer scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails to bank staff posing as Abrigo or Sageworks asking them to re-enter credentials or API keys.
- Fake notices aimed at borrowers who use the Sageworks portal, asking for documents or logins.
- If borrower data was taken, targeted fraud using real loan and business details.
What to do if you are affected
- 01Banks and credit unions using Sageworks should rotate Sageworks API keys, as some researchers advised, and review their own access logs.
- 02Borrowers should log in to the portal only through the bank's own link and ignore messages asking for documents or passwords.
- 03Wait for official notices from your bank or Abrigo and verify any message by calling a number you already trust.
- 04Watch bank and credit reports for unfamiliar activity if you receive a breach notice.
- 05Do not send loan documents by email in response to unsolicited requests.
Frequently asked questions
Was customer data stolen from Sageworks?
Unknown. Abrigo confirmed unauthorized access and says it has been contained, but has not said whether data was accessed or taken. Sageworks stores sensitive loan documents, so affected banks may issue notices.
Which services were affected?
Online Portal Now, Sageworks Analyst and the Sageworks API. Most functionality was restored on 3 November, with the borrower-facing portal still down when American Banker reported.
Is this related to earlier Abrigo incidents?
Abrigo has not said. American Banker notes an August 2025 Salesforce-related intrusion and an April 2026 ShinyHunters pay-or-leak attempt, and that Abrigo did not say whether this incident is related.
Is there a ransomware claim?
We found no claim by any group for this incident. BleepingComputer originally called it a suspected cyberattack and said the cause was unconfirmed.
Sources
- Abrigo confirms data security incident caused 3-day outage, American Banker, 2026-11-03
- Fintech platform Sageworks taken offline after suspected cyberattack, BleepingComputer, 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.