Kiteworks restores systems after proactive weekend shutdown

Kiteworks said it restored all customer systems after a weekend shutdown prompted by credible threat intelligence from federal authorities. The company says it found and patched a previously unknown vulnerability, with no evidence of exploitation or compromise.

Why it matters: - Kiteworks took the unusual step of asking customers to take systems offline to protect sensitive data before any confirmed attack. - The response also exposed a previously unknown vulnerability, showing how preemptive action can reduce risk when threat intelligence is credible. - The company says customer-hosted and Kiteworks-hosted environments are back online, limiting disruption after the shutdown.

What happened: - Kiteworks issued a preventive shutdown recommendation on Sept. 25 after receiving credible threat intelligence from federal authorities. - The company said all customer systems can now return to normal operation. - Systems hosted by Kiteworks for customers have been restored and are operating normally. - Customers who have not yet restarted their environments can bring Kiteworks systems back online. - The company worked through the weekend with federal authorities, engineering teams and security teams.

The details: - Continuous monitoring during the threat window found no unusual activity. - Kiteworks said there is no evidence that Kiteworks systems or customer systems were compromised. - During the shutdown, the company identified a previously unknown critical vulnerability tied to features enabled for less than 1% of its customer base. - Kiteworks developed and deployed a fix during the shutdown and added extra protections across all environments. - The company said there is no evidence the vulnerability was exploited. - Other Kiteworks products were not affected. - Customers can contact technical support at support@kiteworks.com or through the support portal and support website.

Between the lines: - The move highlights a security posture that favors certainty and containment over availability when credible warnings surface. - Kiteworks framed the decision as a deliberate tradeoff: temporary disruption now versus a larger data risk later. - The company’s public emphasis on federal coordination suggests the threat intelligence was serious enough to justify broad operational changes. - CEO Jonathan Yaron said the company chooses to act on credible warnings rather than wait for evidence of an attack. - CISO Frank Balonis said the company would make the same decision again to protect customer data.

What's next: - Kiteworks said customers can return systems to service if they have not already restarted them. - The company will continue directing customers to support channels for questions and recovery help. - Ongoing monitoring will likely remain a focus as customers bring systems fully back online.

The bottom line: - Kiteworks says it shut down first, found the weakness, fixed it, and restored services without evidence of exploitation.