Abrigo, a financial software company that serves banks and credit unions, has confirmed a data security incident tied to its Sageworks lending platform. The company says it found irregular activity on October 30, 2026 and took the application offline.
As of this writing, Abrigo has not said whether any data was taken, what type of information was involved, or how many people may be affected.
Abrigo’s Data Breach Investigation
Abrigo provides lending, risk management, and anti-money-laundering software to community banks and credit unions. According to published reports, the company serves more than 2,400 of these institutions across the United States. One of its products, Sageworks, is used by lenders to take in loan applications, analyze a borrower’s finances and credit, and monitor loan portfolios. Because the platform sits between a bank and its borrowers, it can hold a wide range of sensitive financial and personal information.
The company’s public status page says Abrigo identified irregular activity in its environment on October 30, 2026 and, out of an abundance of caution, disabled the Sageworks application. Three services were affected: Sageworks Analyst, an analytics dashboard used by lenders; the Sageworks API, which lets a bank’s other systems exchange data with the platform; and Online Portal Now, the portal where borrowers fill out loan applications. The company described the work as emergency maintenance and apologized for the late notice to its customers.
On November 2, 2026, a company spokesperson told the trade publication American Banker that Abrigo is investigating a recent data security incident related to the Sageworks platform. The spokesperson said the investigation is being carried out with the support of third-party specialists, that the unauthorized access has been contained, and that the company has no evidence of continued unauthorized access to the system. By that morning most of the platform was available again, although the features that face borrowers, including the online application portal, stayed offline for longer.
What remains unknown is significant. Abrigo has not publicly confirmed whether data was copied or taken, which records may have been viewed, whether any individual customers of its bank clients are affected, or how the intruder got in. It has not named a responsible party. Security researchers have suggested that banks using the platform rotate their API keys as a precaution, which is a standard step after an incident involving a service that connects to other systems.
This is not the first time Abrigo has been in the news for security reasons. American Banker reports the Sageworks event is the third security incident involving the company in about 14 months, and that the earlier two exposed business contact information linked to its Salesforce database. In April 2026, the ShinyHunters extortion group also claimed to have obtained about 1.7 million Salesforce records from the company. That claim was not confirmed by Abrigo as far as the public record shows, and it should be kept separate from the Sageworks incident until the company says otherwise.
Financial technology vendors are an attractive target because one successful intrusion can reach the records of many lenders at once. Loan files commonly include identity details, income and tax information, business financial statements, and account numbers, which are the building blocks for fraud and identity theft. That is why regulators and banks treat a vendor incident seriously even before the exact scope is known, and why customers of the affected lenders are often advised to stay alert in the weeks after an announcement.
When a software vendor is the one affected, the people whose information is at stake are often not the vendor’s own customers but the customers of its customers. A borrower who applied for a small-business loan or a commercial mortgage at a local bank may never have heard of Abrigo, yet their application documents could have passed through its systems. State data breach laws generally require notice to affected individuals once an organization determines that personal information was involved, and many require a report to the state attorney general. No such notice or filing has been located yet, so this page will be updated if the company or regulators publish more details.
When Did This Breach Occur?
Abrigo’s own status page puts the discovery of irregular activity on October 30, 2026, a Friday. The Sageworks application was disabled that same day. The company confirmed on November 2, 2026 that the cause was a data security incident involving unauthorized access.
The public record does not say when the unauthorized access began, how long it lasted, or whether it started before October 30, 2026. The company’s statement that the access has been contained suggests it has ended, but the full timeline will likely come from the company’s investigation.
What Information Was Breached?
Abrigo has not confirmed what information was involved, and no data types have been officially listed. Because Sageworks handles loan applications and borrower financial analysis, the platform can hold items such as application documents, financial statements, credit information, and personal details of borrowers. Whether any of that was actually accessed has not been confirmed.
Until the company or a regulator publishes a list, treat any specific claim about exposed data as unverified. If you are notified, the notice should describe exactly what information was involved in your case.
What You Can Do
If you may be connected to Abrigo or to a bank or credit union that uses its software, consider the following steps.
- Watch for a notice from your bank, credit union, or lender, and read it closely to see what information it says was involved.
- Review your bank and credit card statements regularly, and report anything you do not recognize to your financial institution right away.
- Request your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com and look for accounts or inquiries you did not authorize.
- Consider placing a free fraud alert or a security freeze with each of the three credit bureaus, keeping in mind that a freeze can delay new credit applications.
- Be cautious with calls, texts, and emails that mention your loan or this incident, especially ones that ask for your Social Security number or account information.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against Abrigo
People whose personal information is exposed in a data security incident may have legal options if the organization failed to use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved, how the incident happened, and how the organization responded.
If you believe your information was involved in the Abrigo incident, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of your information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
