Kiteworks has advised customers to temporarily shut down their systems after receiving credible intelligence from federal authorities that a threat actor may attempt to target some Kiteworks systems. In a September 25 advisory, the secure file sharing company recommended a nine-hour precautionary shutdown window over the weekend, based on each customer’s local time zone.
Which Kiteworks Customers Need to Act?
Organizations that manage their own Kiteworks installations, whether on premises or in AWS or Azure, were told to shut down those systems during the window specified in their customer advisory. Kiteworks said it would handle the shutdown for systems it hosts, so those customers do not need to shut down their instances themselves. The company advised customers to run its current release, version 9.5.1, which it says addresses all known vulnerabilities.
Is There a Confirmed Kiteworks Breach?
Kiteworks said it has no indication that its systems or customers’ systems have been compromised. The shutdown is a preventive measure, not a response to a confirmed breach. The company has not identified the threat actor or announced a new vulnerability tied to the warning.
For defenders, the immediate priority is to check the hours in Kiteworks’ direct customer notice, confirm who is responsible for any self-managed installation, and plan the shutdown and restart around affected file sharing workflows. Teams should continue watching Kiteworks’ official communications for changes to the guidance.