Kiteworks asks customers to power down for nine hours to guard against zero-day attacks
Kiteworks told customers to shut its file-transfer servers for nine hours this weekend after a federal warning. The company says its current release fixes every known flaw, so the outage guards against one it does not know about.
The Investor · Invest desk
What happened
- Kiteworks will switch off the systems it hosts itself, but customers running the software on-premises or on AWS or Azure have to shut down their own.
- The company would not say which agency warned it or which hacking group may be behind the threat; the FBI declined to comment and CISA would not comment on the record.
- A healthcare customer told TechCrunch it took its server down immediately and that the outage is delaying doctors' ability to contact patients.
- Subsidiaries including Zivver, DRACOON, totemo and ownCloud are not affected by the threat, according to the company.
Why it matters
- What it costs cost Customers who run their own servers pay for the precaution twice: staff time for the shutdown on top of the lost service. Kiteworks takes on the work only for the systems it hosts.
- Who's exposed exposure Servers left running this weekend put at risk the files sent through them and never deleted, the stored data an extortion gang took from hundreds of organisations through an Accellion flaw.
- What doesn't add up contradiction Kiteworks called its source law enforcement in the customer email and to TechCrunch, but federal intelligence authorities in its release, so customers cannot tell which agency to check the warning with.
Next story · Security · Oct 8
Ten agencies tie China-linked intrusions across several sectors to Integrity Technology GroupConfirmed13 publishers
The email Kiteworks sent customers on Friday named the fear: attackers exploiting vulnerabilities currently unknown to the company [3]. Kiteworks customer support wrote to heise that the reason for the shutdown was "to protect against any potential zero-day attacks" [4]. A version number tells you how exposed you are to bugs someone has already found. If nobody at the vendor has found the bug, there is nothing to install, and the only control left is to turn the software off. Kiteworks asked for that even on servers that cannot be reached from the internet, because it cannot say with certainty what other routes in might exist [6]. "We have no indication that Kiteworks or our customers' systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach," said Frank Balonis, the company's chief information security officer [2].
The window grew between that email and the press release [20][19]. "We strongly recommend you shut down your Kiteworks system for six hours," Balonis wrote to customers, according to heise [20]. Heise put the Central European slot at 4 a.m. to 10 a.m. on Saturday, September 26 [21]. The release, dated the same Saturday, asks for nine hours in each customer's local time zone [19]. That is three hours more, a window 50% longer than the one first requested [22].
Security researcher Kevin Beaumont pointed to at least a thousand internet-facing Kiteworks systems, and TechCrunch said that number is likely an overcount of affected customer systems [14]. Nine hours across a thousand systems comes to 9,000 system-hours offline [23]. That total leaves out the servers with no internet exposure, which Kiteworks also wants shut [6]. The company says its platform serves over 100 million end-users and thousands of enterprises and government agencies [8].
Heise compared the case to the cl0p gang's use of flaws in the MOVEit transfer software for extortion [15]. In Germany, according to heise, Kiteworks customers include several state banks and insurers, a media group, consulting firms and automotive suppliers [9].
Suppose the window passes quietly and servers restart on the same code. Then any flaw that was unknown on Friday is still there when they come back up [3]. A release after 9.5.1 would mean the company found something, and that the shutdown bought time to fix it [2]. The worst case is attackers reaching servers that customers left running. I think only the second outcome turns nine hours of downtime into a lasting cut in risk, because switching off protects against an attack on a known date and does nothing about the flaw itself. Balonis's email supports the counter-case: it warned of an attack that "may be imminent this weekend" [20]. If the intelligence concerned one timed operation, a bounded shutdown was the right tool. That view is borne out if servers return without a new release and no exploitation surfaces in the weeks after.
What to watch
- Whether Kiteworks ships a release after 9.5.1 once the window closes; a new version would mean the company found the flaw it feared.
- Confirmation from the FBI, CISA or Germany's BSI of who issued the warning and what it covered.
- Reports of exploitation against Kiteworks servers that stayed online through the weekend.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption50
- Hype gap+25
- Incentives65
- Confidence55
Perspective Coverage
3 publishers- Builder
- Builder 12%
- Operator
- Operator 63%
- Investor
- Investor 25%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
"Kiteworks received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems," said Frank Balonis, Chief Information Security Officer, Kiteworks.
- [2]
"We have no indication that Kiteworks or our customers' systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach. Kiteworks has accounted for all known vulnerabilities in our current release, 9.5.1, and we continue to recommend customers run the latest version."
- [3]
According to a copy of the email Kiteworks sent customers on Friday, the company was concerned about the exploitation of vulnerabilities currently unknown to Kiteworks, known as zero-day flaws.
- [4]
Kiteworks customer support wrote to heise: "The reason we're asking you to shut down the servers is to protect against any potential zero-day attacks."
- [5]
Balonis told TechCrunch the company "received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers."
- [6]
Kiteworks recommends shutting down the servers even before the window and even if they are not accessible from the internet, because it cannot be said with certainty what potential access routes there might be.
- [7]
Kiteworks did not say, when asked, which law enforcement agency alerted it or which hacking group may be behind the threat; the FBI declined to comment and CISA spokesperson Marco DiSandro would not comment on the record.
- [8]
Kiteworks says it protects over 100 million end-users and thousands of global enterprises and government agencies.
- [9]
In Germany, Kiteworks customers include several state banks and insurance companies, a media group, consulting firms, and well-known automotive suppliers.
- [10]
Germany's Federal Office for Information Security (BSI) and Federal Criminal Police Office (BKA) did not respond immediately to heise's request for comment.
- [11]
Customers who self-manage their Kiteworks systems, on-premises or on AWS or Azure, should shut down those systems themselves during the window; Kiteworks will shut down the customer systems it hosts on their behalf, so hosted customers need take no action.
- [12]
A Kiteworks customer in healthcare told TechCrunch they took their organization's server down immediately, and said the outage is causing delays and disruption to doctors' ability to contact their patients.
- [13]
The threat does not affect other Kiteworks subsidiaries, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder.
- [14]
Security researcher Kevin Beaumont pointed to a listing of at least a thousand internet-facing Kiteworks systems online, though the number is likely an overcount of affected customer systems.
- [15]
Heise noted that the cl0p gang exploited the MOVEit transfer software for extortion and said parallels to the Kiteworks case are striking.
- [16]
Before its rebrand from Accellion in late 2021, a vulnerability in its file-transfer application allowed an extortion gang to mass-hack and steal data from hundreds of organizations.
- [17]
That campaign aimed to steal copies of data previously sent over the internet but not deleted from affected servers, then held the data for ransom.
- [18]
Kiteworks, formerly Accellion, makes tools for transferring large files and sensitive datasets over the internet.
- [19]
Kiteworks is advising customers to facilitate a nine-hour precautionary shutdown window this weekend, in their local time zone; the press release is dated September 26, 2026.
- [20]
Balonis wrote in the customer email: "We have received credible threat intelligence from law enforcement indicating an attack on Kiteworks systems may be imminent this weekend. We strongly recommend you shut down your Kiteworks system for six hours [..]."
- [21]
In Central Europe, all systems are to be shut down on Saturday, September 26, from 4 a.m. to 10 a.m.
- [22]
The nine-hour window in the press release is three hours, or 50%, longer than the six-hour window in the email quoted by heise.
- [23]
A thousand systems offline for nine hours each comes to 9,000 system-hours.
Sources
3 independent publishers whose own reporting we read for this story.
- Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence
einpresswire.com
1 article · September 26, 2026
- Imminent Zero-Day Attack: KiteWorks Urges Customers to Shut Down Servers | heise online
heise.de
1 article · September 25, 2026
- techcrunch.comKiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack | TechCrunch
1 article · September 25, 2026
Topics and entities
Topics
- Zero-Day Vulnerabilities
- Managed file transfer
- Data Extortion