An unusual request from a security vendor
On Friday, September 25, 2026, the enterprise file-transfer company Kiteworks emailed its entire customer base with an unusual request: turn your systems off for nine hours over the weekend. Not patch and monitor. Not rotate credentials. Power down.
The company said it had received credible threat intelligence from federal intelligence authorities indicating that a threat actor might attempt to target some Kiteworks systems. It did not name the agency, the threat actor, or the vulnerability involved. German outlet Heise was first to report the advisory, based on the customer email Kiteworks sent out.
What customers were told to do
Kiteworks, formerly known as Accellion before a 2021 rebrand, sells software that lets organizations move large or sensitive files securely. The shutdown window itself, nine hours, in each customer's own local time zone, was sent privately to customers rather than published, so the exact hours varied by recipient.
The split in responsibility mattered: customers running Kiteworks themselves, whether on their own servers or on Amazon Web Services or Microsoft Azure, were told to shut those systems down on their own. Customers who instead pay Kiteworks to host their environment did not need to do anything, because Kiteworks shut those systems down centrally on its customers' behalf.
A handful of Kiteworks subsidiary products, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder, were explicitly carved out of the advisory as unaffected.
The company says nothing has actually happened
Kiteworks Chief Information Security Officer Frank Balonis was careful to frame the move as precautionary rather than reactive. In comments carried by TechCrunch and in the company's own press release, Balonis said Kiteworks has no indication that its own systems or its customers' systems have been compromised, and described the shutdown as a preventative step rather than a response to a confirmed breach.
The company also pointed to its current software release, version 9.5.1, as containing patches for every vulnerability it currently knows about. That detail is worth sitting with for a moment, because it means Kiteworks asked fully patched customers to go dark anyway.
Why asking customers to unplug is the notable part
Security advisories normally tell customers to apply a patch, restrict network access, or watch for specific indicators of compromise. Asking an entire customer base to physically shut down production systems for hours is a much rarer move, and it tends to happen only when a vendor suspects that whatever is coming is not fully covered by what it has already shipped.
A security analysis posted to the developer community site DEV Community made that point directly: when a vendor pairs a shutdown request with an existing patch, rather than simply pointing customers to the patch, it signals doubt that the patch actually covers the incoming threat. The same analysis noted that Kiteworks disclosed no threat actor, no attack vector, and no indicators of compromise, which leaves customers unable to judge the threat for themselves and shifts the entire cost of caution onto them.
That lack of detail is compounded by Kiteworks' own history. As Accellion, the company's legacy file transfer appliance was the entry point for a 2020-2021 extortion campaign run by the Clop ransomware group, tracked by researchers as UNC2546, that stole data from a long list of Accellion customers and used it for extortion. Reporting on the current advisory has raised that history without claiming any direct link to this weekend's warning.
Security scans cited in coverage of the advisory found more than 1,000 internet-facing Kiteworks systems online, though that figure likely counts individual servers rather than distinct customer organizations, since a single customer can run multiple internet-facing instances.
What it means in practice
For Kiteworks customers, the immediate decision was binary and time-boxed: self-managed environments needed someone to actually flip the switch during the window specified in Kiteworks' email, while hosted customers could treat the notice as informational. For everyone else, the episode is a reminder that file-transfer platforms remain a favorite target for data-theft extortion, precisely because a single appliance can sit in front of enormous volumes of sensitive documents. Organizations that rely on Kiteworks or similar platforms should confirm they are running the latest patched release, ask their vendor directly whether any indicators of compromise have been shared with peers or with information-sharing bodies, and treat a request like this one as a prompt to review how quickly their own environment could be taken offline if a vendor asked again with less notice.
