Kiteworks restores systems after preventive shutdown over credible threat

Kiteworks said customers can bring systems back online after a preventive shutdown on Sept. 25 tied to federal intelligence about a credible threat. The company said monitoring showed no signs of exploitation, and the shutdown exposed a critical vulnerability that was patched before any known compromise.

Why it matters: - The shutdown affected customer systems and hosted environments, but Kiteworks says all systems are now back to normal. - The episode shows how a preventive response to intelligence can uncover and close a critical flaw before it is exploited. - Kiteworks said the vulnerability was limited to a feature enabled in less than 1% of its customer base.

What happened: - Kiteworks recommended customers disconnect their systems on Sept. 25 after receiving federal intelligence about a credible, imminent threat. - The company shut down environments it hosts on behalf of customers and mobilized engineering and security teams with federal intelligence authorities. - Kiteworks now says customers who have not yet done so can reconnect their systems. - All Kiteworks-hosted customer systems have been restored and are operating normally.

The details: - Continuous monitoring during the threat window showed no anomalous activity. - Kiteworks said it has no indication that any Kiteworks system or customer system was compromised. - The shutdown led to the discovery of a previously unknown critical vulnerability. - Kiteworks developed and deployed a fix during the shutdown. - The company also added an extra layer of protection across all environments. - Kiteworks said there is no indication the vulnerability was ever exploited. - The rest of Kiteworks' products were not affected. - Frank Balonis, chief information security officer, said the company chose to ask customers to disconnect production systems because protecting customer data outweighed convenience. - Jonathan Yaron, CEO and chairman, said customers worked through the weekend and overnight alongside Kiteworks teams and federal authorities.

Between the lines: - Kiteworks took a proactive posture that differs from the common industry approach of waiting for proof of an attack. - The company is signaling that intelligence-led shutdowns can be disruptive, but may reduce the chance of a larger breach. - The fact that the flaw was limited to a small subset of users suggests the blast radius may have been narrow, even though the response was broad.

What's next: - Customers that have not reconnected systems can return them to service. - Kiteworks told customers with questions to contact Technical Support or their Customer Success representative. - The company said it intends to keep maintaining the proactive standard it used in this incident.

The bottom line: - Kiteworks says it avoided an exploitation event, patched a critical vulnerability, and restored normal operations after a precautionary shutdown triggered by federal threat intelligence. - More information