Kiteworks tells customers to shut down servers over weekend attack — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Kiteworks CISO Frank Balonis told TechCrunch the company received "credible threat intelligence from law enforcement" that a threat actor may attempt to target some customer systems, calling the advisory "preventative rather than a response to a confirmed breach."
- Kiteworks emailed customers urging a precautionary shutdown before the weekend to guard against potential zero-day vulnerabilities — flaws unknown to the vendor — as the company cannot confirm whether other access routes exist.
- Kiteworks said all known vulnerabilities have been patched in software release 9.5.1, which it recommends all customers adopt.
- Kiteworks declined to name the law enforcement agency or threat actor; the FBI and CISA spokesperson Marco DiSandro both declined or did not comment on the record.
- Security researcher Kevin Beaumont identified at least 1,000 internet-facing Kiteworks systems online, while Kiteworks says its customer base spans healthcare, technology, education, automotive, and government.
- A Kiteworks healthcare customer confirmed to TechCrunch that it took its server offline immediately, causing delays in doctors' ability to contact patients.
- The company, formerly Accellion, was hit by a 2021 vulnerability in its file-transfer app that let an extortion gang mass-hack hundreds of organizations.
Why it matters: Kiteworks' shutdown advisory hits healthcare and government hardest: a healthcare customer confirmed patient-doctor communications are already disrupted, and Beaumont's scan found at least 1,000 exposed systems. The zero-day framing — bugs the vendor doesn't yet know about — means patching to 9.5.1 may not close the gap, which is why Kiteworks is pushing physical shutdowns over software updates.
Ask SkimNews
