Kiteworks Tells Customers to Shut Down Servers After Law Enforcement Warns of Imminent Cyberattack
Kiteworks says law enforcement flagged a credible, imminent threat potentially targeting customer systems, prompting a precautionary server shutdown recommendation for the weekend. No breach is confirmed; customers should upgrade to version 9.5.1, which patches known flaws.
Kiteworks, a file-transfer technology company used by thousands of organizations worldwide, urged its customers on Friday, September 26, 2026, to shut down their servers ahead of a potential cyberattack that could occur as soon as the weekend.
The company’s chief information security officer, Frank Balonis, confirmed to TechCrunch that Kiteworks “received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers.” The alert was first reported by German publication Heise, which obtained an email Kiteworks sent to its customers describing the threat as “imminent.”
Balonis said the precautionary shutdown recommendation was issued while the company and its law enforcement partners work through the matter, and emphasized that no confirmed breach has occurred. “We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach,” he said.
Kiteworks said it is specifically concerned about the potential exploitation of zero-day vulnerabilities — unknown flaws that give the vendor no time to issue a fix before they are exploited. The company told customers it cannot confirm whether additional routes for unauthorized access exist. Kiteworks also recommended that all customers upgrade to its latest software release, version 9.5.1, which it says patches all known vulnerabilities.
Kiteworks did not identify the law enforcement agency that issued the warning or the hacking group believed to be behind the threat. The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) did not respond to requests for comment. Security researcher Kevin Beaumont identified at least a thousand internet-facing Kiteworks systems currently online.
The company serves thousands of customers across healthcare, technology, education, automotive, and government sectors. The warning carries added weight given the company’s history: prior to rebranding from Accellion in late 2021, a vulnerability in its file-transfer software was exploited in a mass hacking campaign that affected hundreds of organizations, with attackers stealing sensitive data and demanding ransom payments.