Kiteworks restores systems after federal threat warning

Kiteworks says all customer systems are back online after a precautionary shutdown tied to a credible threat tip from federal intelligence authorities on Sept. 25. The company says it found and patched a critical vulnerability during the outage and has no evidence of exploitation or compromise.

Why it matters: - Kiteworks says the incident shows a rare case of a software vendor taking its own and customers' systems offline before an attack was confirmed. - The company says the shutdown helped prevent risk to customer data and led to the discovery of a critical vulnerability. - The episode affects organizations that rely on Kiteworks for secure data exchange, governance and compliance.

What happened: - Kiteworks says it recommended that customers disconnect their systems on Sept. 25 after receiving credible threat intelligence from federal authorities. - The company shut down environments it hosts for customers and worked with federal intelligence officials on the response. - Kiteworks says the threat window passed without incident. - The company says all customer systems can now be restored to normal operation. - All systems Kiteworks hosts for customers have been restored and are operating normally.

The details: - During the shutdown, Kiteworks says it discovered a previously unknown critical vulnerability. - The flaw was limited to a feature enabled on less than 1% of the customer base. - Kiteworks says it developed and deployed a fix during the outage. - The company also added an extra layer of protection across all environments. - Kiteworks says it has no evidence the vulnerability was ever exploited. - The company says continuous monitoring showed no abnormal activity. - Kiteworks says there is no indication that any Kiteworks system or customer system was compromised. - No other Kiteworks products were affected. - Customers with questions are directed to Kiteworks Technical Support or their Customer Success representative. - Support contacts include the customer portal at community.kiteworks.com and the support page at kiteworks.com/support.

Between the lines: - The company is framing the shutdown as a proactive security decision rather than a reactive incident response. - Frank Balonis, Kiteworks' chief information security officer, said the company would make the same choice again rather than risk customer data. - Jonathan Yaron, Kiteworks' CEO and chairman, said the company prefers to act on a credible warning instead of waiting for proof of an attack. - The episode highlights the tension between operational continuity and security-first decision-making.

What's next: - Kiteworks says customers who have not already done so can bring their systems back online. - The company says it will keep monitoring systems and maintain the added protections. - Kiteworks says it intends to keep using a proactive response standard when it receives credible threat intelligence.

The bottom line: - Kiteworks says the threat passed without a breach, and the shutdown exposed a critical flaw before attackers could use it.