Abrigo's Sageworks: borrower portal still down

Abrigo shut its Sageworks lending platform off on Friday, October 30, 2026, after the company said it had found activity in the environment it did not recognize. The cutoff was about 11:25 a.m. Eastern. Emergency maintenance ran through the weekend. On Monday, November 2, Abrigo said most of Sageworks was back. Borrower-facing features were still offline.

Abrigo sells cloud software to community banks and credit unions in the United States and says it serves more than 2,400 institutions. Sageworks is the piece lenders use to take a loan application, read a borrower’s finances, judge credit, and watch the book after the loan is booked. That workflow holds bank-customer detail. An outage here is a Monday-morning problem for every credit desk on the product, and an open question about the files underneath it.

What the status line covers

Abrigo’s updates named three services in the outage: Online Portal Now, Sageworks Analyst, and the Sageworks API. The Monday note brought most of that functionality back and left the borrower-facing side down. A lender that reads only “restored” will send applicants into a front door the vendor has left closed. Match the module list to the work the branch still has to finish this week: applications, analyst review, and any core or origination system that calls the API.

Abrigo has said the investigation was still going. It has not described the activity. BleepingComputer asked for more and had no reply by the time its story ran. The public record this week is an open investigation.

Earlier this year a person claiming a role in the ShinyHunters extortion group said they had taken 1.7 million Salesforce records from Abrigo, including names, email addresses, phone numbers, and employee and account data. Public reporting did not confirm that claim. The October 30 status updates do not connect it to this outage. Keep the two items in separate briefs. The work this week is the platform Abrigo actually switched off.

What a lender does while the borrower side is down

Open an incident ticket for Friday’s cutoff even if the analyst screens look ordinary on Tuesday. Name an owner, keep Abrigo’s status notes, and write down which borrower steps are still blocked.

Ask Abrigo, in writing, whether customer or borrower data was accessed, and file the answer with counsel. Rotate Sageworks API keys used by origination, core, and reporting jobs. Researchers watching the outage have told banks and credit unions to rotate those keys while the investigation is open. Start with any key that sat in the environment Abrigo isolated on Friday.

Hold borrower messages that depend on the portal. Send applicants through a channel the bank controls — a branch process, a phone queue, a form on the bank’s own site — until Abrigo marks the borrower features restored. Watch for password-reset mail, loan-status texts, or portal links the institution did not send.

Inventory who signed into Sageworks before 11:25 a.m. Eastern on October 30, and which integrations retried across the weekend. When the borrower side returns, require a fresh session. Then sample a day’s applications for fields that changed while the service was dark.

Abrigo’s Monday restore put the desks back to work and left the public side closed. The keys and the borrower queue stay with the bank until the vendor describes the activity that triggered Friday’s cutoff.

This briefing relies on public reporting by BleepingComputer and on Abrigo’s public status updates. It does not include intrusion steps.