Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
Abrigo
financial services technology (vendor to community banks and credit unions) · United States (customer base nationwide)
What happened
Undisclosed. Abrigo describes 'irregular activity in our environment' and has not said whether data was accessed. BleepingComputer notes that the platform holds borrower financial and banking customer data, and reports that some researchers advised customers to rotate Sageworks API keys.
Lenders at customer banks and credit unions lost access to loan analysis, credit-memo, portfolio and API functions from 30 Oct to 2 Nov. Borrower-facing portal functions remain unavailable, which affects loan document collection from borrowers.
The disruption is confirmed. The organization has not said it was a cyberattack, and no access to data is confirmed. We do not treat this as a confirmed compromise until it does.
What remains unknown
- nature of the irregular activity (intrusion, credential abuse, or other)
- whether customer or borrower data or API credentials were accessed
- number of financial institutions using Sageworks that were affected
- whether this relates to the April 2026 ShinyHunters claim against Abrigo (no evidence of a link)
- when borrower-facing features will be restored
Losses: unknown
Capital around this company
- Current ownerInvestor portfolio pageAccel-Kkr
The investor's portfolio page lists the company as a current investment. A portfolio listing is not a disclosed stake size or control position.
- Current ownerAbrigo: Our investors
Abrigo's investor page names Carlyle (investor since August 2021) alongside Accel-KKR. Ownership split between Accel-KKR and Carlyle is reported as co-majority by press, not disclosed.
Sources
- Abrigo status page: Sageworks Analysis, Sageworks API and Online Portal Now Unplanned Maintenance · 2026-10-30T14:58Z (first post); latest 2026-11-02T12:11Z
- Fintech platform Sageworks taken offline after suspected cyberattack · 2026-11-02 (14:00, page time zone)
- ShinyHunters orchestrates attack on Abrigo, Inc. (tracker page, claim only) · 2026-04-12
Does Abrigo touch your portfolio?
We map a company or a whole book against verified incidents: the lenders, owners and providers around each holding, with what is confirmed and what is not.