# Kiteworks Asks Its Whole Customer Base to Power Down for Nine Hours

Page: https://hirantha.me/blog/kiteworks-asks-its-whole-customer-base-to-power-down-for-nine-hours
Published: 2026-09-27
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: kiteworks, file transfer security, data breach prevention, vulnerability disclosure, accellion

> Kiteworks told customers to shut down their file-transfer systems for nine hours after a still-unnamed threat was flagged by federal investigators.

## An unusual request from a security vendor

On Friday, September 25, 2026, the enterprise file-transfer company Kiteworks emailed its entire customer base with an unusual request: turn your systems off for nine hours over the weekend. Not patch and monitor. Not rotate credentials. Power down.

The company said it had received credible threat intelligence from federal intelligence authorities indicating that a threat actor might attempt to target some Kiteworks systems. It did not name the agency, the threat actor, or the vulnerability involved. German outlet Heise was first to report the advisory, based on the customer email Kiteworks sent out.

## What customers were told to do

Kiteworks, formerly known as Accellion before a 2021 rebrand, sells software that lets organizations move large or sensitive files securely. The shutdown window itself, nine hours, in each customer's own local time zone, was sent privately to customers rather than published, so the exact hours varied by recipient.

The split in responsibility mattered: customers running Kiteworks themselves, whether on their own servers or on Amazon Web Services or Microsoft Azure, were told to shut those systems down on their own. Customers who instead pay Kiteworks to host their environment did not need to do anything, because Kiteworks shut those systems down centrally on its customers' behalf.

A handful of Kiteworks subsidiary products, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder, were explicitly carved out of the advisory as unaffected.

## The company says nothing has actually happened

Kiteworks Chief Information Security Officer Frank Balonis was careful to frame the move as precautionary rather than reactive. In comments carried by TechCrunch and in the company's own press release, Balonis said Kiteworks has no indication that its own systems or its customers' systems have been compromised, and described the shutdown as a preventative step rather than a response to a confirmed breach.

The company also pointed to its current software release, version 9.5.1, as containing patches for every vulnerability it currently knows about. That detail is worth sitting with for a moment, because it means Kiteworks asked fully patched customers to go dark anyway.

## Why asking customers to unplug is the notable part

Security advisories normally tell customers to apply a patch, restrict network access, or watch for specific indicators of compromise. Asking an entire customer base to physically shut down production systems for hours is a much rarer move, and it tends to happen only when a vendor suspects that whatever is coming is not fully covered by what it has already shipped.

A security analysis posted to the developer community site DEV Community made that point directly: when a vendor pairs a shutdown request with an existing patch, rather than simply pointing customers to the patch, it signals doubt that the patch actually covers the incoming threat. The same analysis noted that Kiteworks disclosed no threat actor, no attack vector, and no indicators of compromise, which leaves customers unable to judge the threat for themselves and shifts the entire cost of caution onto them.

That lack of detail is compounded by Kiteworks' own history. As Accellion, the company's legacy file transfer appliance was the entry point for a 2020-2021 extortion campaign run by the Clop ransomware group, tracked by researchers as UNC2546, that stole data from a long list of Accellion customers and used it for extortion. Reporting on the current advisory has raised that history without claiming any direct link to this weekend's warning.

Security scans cited in coverage of the advisory found more than 1,000 internet-facing Kiteworks systems online, though that figure likely counts individual servers rather than distinct customer organizations, since a single customer can run multiple internet-facing instances.

## What it means in practice

For Kiteworks customers, the immediate decision was binary and time-boxed: self-managed environments needed someone to actually flip the switch during the window specified in Kiteworks' email, while hosted customers could treat the notice as informational. For everyone else, the episode is a reminder that file-transfer platforms remain a favorite target for data-theft extortion, precisely because a single appliance can sit in front of enormous volumes of sensitive documents. Organizations that rely on Kiteworks or similar platforms should confirm they are running the latest patched release, ask their vendor directly whether any indicators of compromise have been shared with peers or with information-sharing bodies, and treat a request like this one as a prompt to review how quickly their own environment could be taken offline if a vendor asked again with less notice.

## Questions

**What is Kiteworks and why did it tell customers to shut down?**
Kiteworks is an enterprise file-transfer and secure communications vendor, formerly known as Accellion, that received credible threat intelligence from federal authorities suggesting a threat actor might target its systems, and asked customers to power down for nine hours as a precaution.

**Was any Kiteworks customer actually breached?**
Kiteworks says it has no indication that its own systems or any customer's systems have been compromised, and describes the shutdown as preventative rather than a response to a confirmed incident.

**Do I need to do anything if I use Kiteworks?**
If you self-manage Kiteworks on your own servers, AWS, or Azure, you were expected to shut the system down yourself during the window Kiteworks emailed you; if Kiteworks hosts your environment, the company handled the shutdown on your behalf and no action was required.

**Is this related to the old Accellion data breaches?**
Kiteworks was previously known as Accellion, whose legacy file-transfer appliance was exploited by the Clop group in 2020 and 2021, but reporting on this advisory has not linked the current threat intelligence to that earlier campaign.

## Sources

- [Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack](https://thehackernews.com/2026/09/kiteworks-urges-customers-to-shut-down.html), The Hacker News
- [Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack](https://techcrunch.com/2026/09/25/kiteworks-urges-customers-to-shut-down-their-servers-amid-imminent-threat-of-cyberattack/), TechCrunch
- [Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence From Federal Intelligence Authorities](https://www.kiteworks.com/company/press-releases/kiteworks-precautionary-shutdown-advisory/), Kiteworks
- [Kiteworks Tells Customers to Go Dark for 9 Hours on a Federal Tip](https://dev.to/etairos/kiteworks-tells-customers-to-go-dark-for-9-hours-on-a-federal-tip-1o2o), DEV Community