Moliyaviy texnologiya kompaniyasi Abrigo o'zining Sageworks risklarni boshqarish ilovasini, qarz oluvchilarga mo'ljallangan imkoniyatlardan tashqari, o'z muhitida aniqlangan "noodatiy faoliyat" tufayli yuzaga kelgan uzilishdan so'ng qayta tikladi.
30-oktabr kuni kompaniya shubhali faoliyatni tekshirish uchun favqulodda texnik xizmat ko'rsatishni boshladi va Sageworks ilovasini oflayn holatga keltirdi, uzilish hafta oxirigacha davom etdi.
Abrigo AQSh bo'ylab jamoat banklari va kredit uyushmalari uchun bulutli dasturiy ta'minot va analitik yechimlar taqdim etadi. Kompaniya ma'lumotlariga ko'ra, u 2400 dan ortiq tashkilotga xizmat ko'rsatadi.
Uning Sageworks mahsuloti — bu kreditorlarga kredit arizalarini qayta ishlash, qarz oluvchilarning moliyaviy holatini tahlil qilish, kreditga layoqatlilikni baholash va kredit portfellarini kuzatish imkonini beradigan dasturiy platforma.
Tabiatiga ko'ra, Sageworks bank mijozlarining ma'lumotlarini o'z ichiga olgan nozik ma'lumotlarni qayta ishlaydi.
"Biz o'z muhitimizda noodatiy faoliyatni aniqladik va ehtiyot chorasi sifatida Sageworks ilovasini taxminan soat 11:25 ET da o'chirdik", — dedi kompaniya juma kuni.
Hafta oxiridagi holat yangilanishlarida Abrigo tekshiruv davom etayotganini aytdi, ammo hodisaning tabiati haqida tafsilotlarni oshkor qilmadi.
Hodisa quyidagi xizmatlarga ta'sir qildi: Online Portal Now, Sageworks Analyst va Sageworks API.
Bugungi kundagi so'nggi yangilanishida kompaniya Sageworks funksiyalarining aksariyati qayta tiklanganini, qarz oluvchilarga mo'ljallangan xususiyatlardan tashqari, ma'lum qildi.
BleepingComputer Abrigo bilan qo'shimcha tafsilotlar uchun bog'landi, ammo nashr vaqti kelguncha javob olmadi. Hodisaning tabiati oshkor qilinmaguncha, uzilishning sababi buzilish yoki texnik muammo ekanligi noaniq qoladi.
Joriy yilning boshida, ShinyHunters tovlamachilik guruhi a'zosi deb taxmin qilingan shaxs Abrigoga hujum qilganini da'vo qilib, shaxsiy identifikatsiya ma'lumotlari va turli ichki korporativ ma'lumotlarni o'z ichiga olgan 1,7 million Salesforce yozuvini o'g'irlaganini aytdi.
Tahdid qiluvchi o'sha paytda to'liq ismlar, elektron pochta manzillari, telefon raqamlari, xodimlar va hisob ma'lumotlarini o'g'irlaganini aytdi.
Ma'lumotlar buzilishi tasdiqlanmagan bo'lsa-da, ba'zi kiberxavfsizlik tadqiqotchilari Abrigo yechimlaridan foydalanadigan banklar va kredit uyushmalariga Sageworks platformasi uchun API kalitlarini almashtirishni tavsiya qildilar.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning sun'iy intellekt agentlari elektron pochta niyati, konteksti va xatti-harakatini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan MX o'zgarishlarsiz nima o'tib ketayotganini ko'ring.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.
On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.
Abrigo provides cloud-based software and analytics solutions for community banks and credit unions across the United States. According to the company, it serves more than 2,400 entities.
Its Sageworks product is a software platform that helps lenders process loan applications, analyze borrowers’ finances, assess creditworthiness, and monitor loan portfolios.
Due to its nature, Sageworks handles sensitive information, including banking customer details.
"We identified irregular activity in our environment, and, out of abundance of caution, we disabled the Sageworks application at approximately 11:25 am ET," the company said on Friday.
In status updates over the weekend, Abrigo said its investigation was ongoing but did not disclose details about the nature of the incident.
The incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.
In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features.
BleepingComputer reached out to Abrigo for more details, but we have not received a response by publication time. Until the nature of the incident is disclosed, it is unclear if the outage was caused by a breach or a technical issue.
Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.
The threat actor said at the time that they exfiltrated full names, email addresses, phone numbers, employee and account data.
Although a data breach has not been confirmed, some cybersecurity researchers advised banks and credit unions using Abrigo's solutions to rotate the API keys for the Sageworks platform.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.