Kiteworks, a provider of secure file transfer solutions, has directed its customers to shut down their systems temporarily amid concerns of an imminent cyberattack. The company issued the advisory following receipt of threat intelligence from law enforcement indicating that malicious actors might target its platforms. The warning was initially reported by German outlet Heise, which cited an internal email sent to clients about a potential breach as early as the upcoming weekend.

Kiteworks spokesperson Frank Balonis confirmed to TechCrunch that the company acted out of caution, emphasizing that no compromise of its infrastructure had been detected. "We received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers," Balonis stated. "Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we and our law enforcement partners work through the matter." The company clarified that the alert was preventative and not a response to an active breach.

The advisory urged customers to disconnect their systems immediately to mitigate risks associated with zero-day vulnerabilities — previously unknown flaws that could be exploited before patches are applied. Kiteworks noted that its latest software version, 9.5.1, had addressed all known vulnerabilities and recommended its use. However, the company acknowledged uncertainty about additional attack vectors that might exist.

The scope of the potential impact remains unclear. Kiteworks serves thousands of clients across healthcare, technology, education, automotive, and government sectors. Security researcher Kevin Beaumont identified over a thousand internet-facing Kiteworks systems online, though the actual number of affected installations may be lower. One healthcare client confirmed to TechCrunch that their organization had taken down its server in response to the alert, resulting in operational delays and disruptions to patient communications.

This is not the first time Kiteworks has faced security challenges. Prior to its rebranding from Accellion in 2021, a critical flaw in its file transfer platform was exploited by an extortion group to infiltrate hundreds of organizations. The attackers exfiltrated sensitive data and demanded ransom payments to prevent public disclosure. That incident was part of a broader campaign targeting file transfer services, highlighting recurring risks in enterprise data-sharing infrastructure.

Kiteworks has not disclosed the identity of the law enforcement agency involved or attributed the threat to a specific hacking group. The FBI and CISA declined to comment on the matter when approached by TechCrunch. The company has not provided further details about the nature of the threat beyond the general warning.

Customers are advised to remain vigilant and follow official guidance while investigations continue. Kiteworks has not indicated any expectation of service restoration timelines or confirmed whether systems will be fully brought back online.

Zack Whittaker covers cybersecurity for TechCrunch, focusing on policy, breach investigations, and systemic vulnerabilities in digital infrastructure. He previously reported on data privacy and security for outlets including The Guardian and The Intercept. Whittaker holds a journalism degree from the University of Stirling and can be contacted securely via Signal at zackwhittaker.1337 or by email at zack.whittaker@techcrunch.com.