Abrigo has restored most of its Sageworks platform after a weekend outage, but borrower-facing features remained unavailable in its November 2 update. The company took the application offline on October 30 after detecting irregular activity, according to its public incident record.
The company says it disabled Sageworks at approximately 11:25 a.m. Eastern time as a precaution. Updates through the weekend described an investigation and plans to bring services back. At 7:11 a.m. EST on November 2, Abrigo announced the partial restoration and said monitoring would continue.
Abrigo lists three affected services: Online Portal Now, Sageworks Analyst and the Sageworks API.
The cause remains unclear
The public updates reviewed for this article do not establish whether attackers accessed customer data or credentials. They do not identify ransomware or a responsible group. Service restoration, on its own, does not answer those questions.
Sageworks supports loan applications, borrower financial analysis and portfolio management. Abrigo supplies software to community banks and credit unions, making interruptions relevant to institutions that depend on those workflows. BleepingComputer reported on November 2 that it had sought further details from the vendor without receiving a response before publication.
For lenders, the immediate distinction is between functions that have returned and the customer-facing capabilities still excluded from the restoration notice. Abrigo says more specific information has been sent by email to institutions’ designated product and IT security contacts. Those communications, alongside subsequent status updates, are the next place to check for changes.
Sources: Abrigo incident updates, October 30–November 2, 2026; BleepingComputer, November 2, 2026.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
