Kiteworks restores systems after shutdown over credible threat

Kiteworks says customers can bring systems back online after a precautionary shutdown prompted by federal intelligence about a potential imminent attack. The company says it found and fixed a previously unknown critical vulnerability during the shutdown and has no evidence of exploitation.

Why it matters: - Kiteworks’ decision to halt customer systems shows how seriously the company viewed the threat. - The shutdown helped the company identify a critical vulnerability before it appears to have been exploited. - The move reduced risk for customer data and for Kiteworks-hosted environments.

What happened: - Kiteworks said all customer systems may be restored to normal operations after a precautionary shutdown recommendation issued Sept. 25. - The recommendation followed credible threat intelligence from federal intelligence authorities. - Kiteworks told customers to take their systems offline and shut down environments the company hosts on their behalf. - The company says customers who have not already restarted can bring their Kiteworks systems back online. - Kiteworks says all systems it hosts for customers are back up and operating normally.

The details: - Continuous monitoring during the shutdown showed no abnormal activity. - Kiteworks says it has no indication that any Kiteworks or customer system was compromised. - During the shutdown, Kiteworks and federal intelligence authorities identified a previously unknown critical vulnerability. - The vulnerability was confined to a capability enabled for less than 1% of the customer base. - Kiteworks developed and deployed a fix during the shutdown window. - The company also applied an additional protective layer across all environments. - Kiteworks says it has no indication the vulnerability was ever exploited. - All other Kiteworks products were unaffected. - Customers with questions were directed to Kiteworks Technical Support or a customer success representative. - Contact options listed by Kiteworks include email at support@kiteworks.com, the customer community portal, and support information.

Between the lines: - Kiteworks chose a proactive shutdown instead of waiting for proof of an attack. - Chief Information Security Officer Frank Balonis said the company chose certainty over convenience because customer data was at stake. - CEO and Chairman Jonathan Yaron said customers and partners acted quickly, and he credited federal authorities for the outcome. - Yaron also said the industry standard is often to wait for proof of attack, while Kiteworks prefers to act on credible warning.

What's next: - Kiteworks says customers can restart systems if they have not already done so. - The company will likely continue monitoring for signs of exploitation or follow-on risk. - Kiteworks said it intends to keep its proactive standard for responding to credible threats.

The bottom line: - Kiteworks says the shutdown exposed and closed a critical vulnerability before it was exploited, and customers can now return to normal operations.