Kiteworks restores systems after credible federal threat warning

Kiteworks said customers can bring systems back online after a Sept. 25 precautionary shutdown tied to credible federal intelligence about an imminent threat. The company says the threat window passed without incident, no systems appear to have been compromised and a critical vulnerability was fixed during the shutdown.

Why it matters: - Kiteworks’ decision to shut down customer systems shows how security teams can act on threat intelligence before an attack is confirmed. - The company says the move helped uncover and patch a critical vulnerability before it was exploited. - Customers that rely on Kiteworks for secure data exchange can now resume normal operations.

What happened: - Kiteworks said all customer systems can be restored to normal operation after a precautionary closure recommended on Sept. 25. - The shutdown followed intelligence from federal authorities about a credible, potentially imminent threat. - Kiteworks said the threat window passed without incident. - Continuous monitoring during the period showed no anomalous activity. - The company said it has no indication that any Kiteworks system or customer system was compromised. - Customers who have not yet done so can bring their Kiteworks systems back online. - All systems Kiteworks hosts on behalf of customers are back up and operating normally.

The details: - During the shutdown, Kiteworks and federal intelligence authorities worked together to respond to the threat. - The company said that work uncovered a previously unknown critical vulnerability. - The vulnerability was limited to a feature enabled in less than 1% of the customer base. - Kiteworks developed and deployed a fix during the shutdown. - The company also added an additional layer of protection across all environments. - Kiteworks said it has no evidence the vulnerability was ever exploited. - The rest of the Kiteworks product line was not affected. - Kiteworks told customers to contact Technical Support or their Customer Success representative with questions. - The company provided support contact options including email at support@kiteworks.com, the customer community portal, and the support page.

Between the lines: - Frank Balonis, Kiteworks chief information security officer, said asking customers to disconnect production systems was not a decision the company took lightly. - Balonis said the company chose to act because customer data was too important to leave at risk. - Jonathan Yaron, Kiteworks CEO and chairman, said customers and staff worked through the weekend and overnight to support the shutdown and recovery. - Yaron said the company values that trust and does not take it for granted. - Yaron said Kiteworks prefers proactive action on credible warnings rather than waiting for proof of an attack. - The episode highlights a broader industry tradeoff between certainty and speed during possible cyber threats.

What's next: - Kiteworks says customers can restore their systems to normal operation now. - The company will continue supporting customers through Technical Support and Customer Success. - Kiteworks says it intends to keep using a proactive standard when it receives credible threat warnings.

The bottom line: - Kiteworks says it contained a credible threat, fixed a critical vulnerability and restored operations without evidence of exploitation.