SAN FRANCISCO, September 26 — Kiteworks, the file-transfer company formerly known as Accellion, told customers on Friday to shut their systems down over the weekend after receiving what its chief information security officer described as credible threat intelligence from law enforcement. The alert was first reported by the German publication Heise, which cited an email Kiteworks sent to customers warning of an “imminent” attack that could arrive as soon as the weekend. Kiteworks confirmed to TechCrunch that it had notified customers about the potential threat.
Frank Balonis, Kiteworks’ chief information security officer, said by email on Friday that the company “received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers.” He added: “Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we and our law enforcement partners work through the matter.” Balonis also said the company is “not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach.” Under the hood, the concern is a zero-day.
In the customer email, Kiteworks said it was worried about exploitation of vulnerabilities currently unknown to the company — flaws that give a vendor no time to fix them before they are used. The email urged customers to shut down their systems before the weekend, if not sooner, to “protect against any potential zero-day attacks,” noting the company cannot confirm whether other routes for improper access exist. Kiteworks did not say which law enforcement agency alerted it, nor which hacking group might be behind the threat.
The FBI declined to comment. Marco DiSandro, a spokesperson for the US cybersecurity agency CISA, would not comment on the record when asked about the alert.
The detail that matters: who is exposed
It is unclear exactly how many customers may be affected. Kiteworks says on its website that it has thousands of customers across healthcare, technology, education, automotive and government, among other sectors. Security researcher Kevin Beaumont pointed to a listing of at least a thousand internet-facing Kiteworks systems online today, though that number is likely an overcount of affected customer systems.
One Kiteworks customer who works in healthcare told TechCrunch they received the alert and took down their organisation’s server immediately. The person, who asked not to be publicly named, said the outage is causing delays and disruption to doctors’ ability to contact their patients.
Balonis said the company has fixed all known vulnerabilities in its latest software release, version 9.5.1, which it recommends all customers use.
A familiar name in file-transfer attacks
Kiteworks is no stranger to cyberattacks. Prior to its rebrand from Accellion in late 2021, a vulnerability in its file-transfer application allowed an extortion gang to mass-hack and steal data from hundreds of organisations that relied on the product to send customer or internal corporate data over the internet. That campaign was part of a broader effort targeting file transfer products, with the goal of stealing copies of data previously sent over the internet but not deleted from the affected servers.
The hackers then held the data for ransom, threatening to publish customers’ information if victims did not pay. As ever, the technical reality is that a precautionary shutdown is a blunt instrument: it removes the attack surface, and it also removes the service.
For now, the company’s position is that nothing has been confirmed breached. What to watch next is whether Kiteworks names the law enforcement partner behind the intelligence, whether the threatened zero-day materialises over the weekend, and whether version 9.5.1 holds.
