Kiteworks restores systems after preventive shutdown over credible threat

Kiteworks says all customer systems can be brought fully back online after a preventive shutdown ordered on Sept. 25 in response to credible threat intelligence from European and U.S. federal agencies. The company says the threat window passed without incident, no systems were compromised and the shutdown exposed a previously unknown critical vulnerability that has now been fixed.

Why it matters: - Kiteworks says the weekend shutdown protected customer data while the company and intelligence partners worked to assess a credible threat. - The incident shows how a vendor can trade short-term disruption for faster risk reduction when threat intelligence points to a possible attack. - The company says it found and fixed a critical vulnerability during the outage, reducing exposure for affected customers.

What happened: - Kiteworks told customers to take systems offline on Sept. 25 after receiving credible threat intelligence from multiple European and U.S. federal intelligence services. - Kiteworks also took down the environments it hosts and manages for customers. - The company says the threat window passed without incident. - Continuous monitoring showed no abnormal activity. - Kiteworks says it has no evidence that any Kiteworks system or customer system was compromised. - Customers who have not yet restarted can do so now. - All systems hosted and managed by Kiteworks for customers are back online and operating normally.

The details: - During the shutdown, Kiteworks mobilized its engineering and security teams alongside intelligence services. - That work led to the discovery of a previously unknown critical vulnerability. - The vulnerability was limited to a feature enabled for less than 1% of the customer base. - Kiteworks developed and deployed a fix during the same period. - The company added an extra layer of protection across all environments. - Kiteworks says it has no indication the vulnerability was ever exploited. - The company says no other Kiteworks products were affected. - Customers with questions can contact Kiteworks technical support or their Customer Success contact. - Support is available by email at support@kiteworks.com, through the customer portal, or on the support page. - Phone support is available in North America at +1-888-654-3778, internationally at +1-650-485-4350, in Australia at +61 (0)2 7908 3819, in Germany at +49 (0)711 9533-9989, in Israel at +972 (0)2 374-0148, in New Zealand at +64 (0)4 831-0761, in Singapore at +65 3159 3269 and in the U.K. at +44 (0)20 3608-6370.

Between the lines: - Frank Balonis, Kiteworks chief information security officer, said asking customers to take production systems offline was not a decision the company made lightly. - Balonis said Kiteworks chose certainty over convenience because customer data was not something the company was willing to gamble with. - Jonathan Yaron, Kiteworks CEO and chairman, said customers gave up their weekend and many teams worked overnight with Kiteworks staff. - Yaron said the company is grateful to federal authorities for the intelligence and collaboration that made the outcome possible. - Yaron said Kiteworks would rather act on a credible warning than wait for proof of an attack. - The episode underscores a security posture that favors prevention over confirmation when the stakes involve private data.

What's next: - Customers can restart systems that have not yet been brought back online. - Kiteworks will continue supporting customers through its support channels. - The company is likely to use the incident as evidence that proactive shutdowns can prevent bigger breaches when threat intelligence is strong.

The bottom line: - Kiteworks says a disruptive but preemptive shutdown helped it avoid a breach and uncover a critical flaw before it was abused.