Abrigo Data Breach: 778,989 Records Exposed to Attackers

In April 2026, HEROIC analysts identified a verified data breach tied to Abrigo, a company that builds compliance, credit-risk, and lending software used by banks and credit unions. The breach exposed 778,989 records, including email addresses, first and last names, phone numbers, and usernames. Because Abrigo's software sits behind the scenes at financial institutions, anyone who has interacted with a bank or credit union that uses these tools should scan your email to check whether their information was included.

Why This Is Dangerous

A record built from an email address, a username, and a phone number is enough to run a convincing impersonation attempt, especially in the financial sector where a fake call from "your bank's vendor" can catch people off guard. Attackers can pair a real name with a real phone number to make a phishing call feel routine rather than suspicious.

What Was Exposed

• Email Address
• First Name
• Last Name
• Phone Number
• Username

Because this data touches the financial services industry, the realistic risks include targeted phishing that references a bank relationship, fraudulent requests framed as account verification, and follow-on attempts to reset the accounts tied to the exposed username. Employees at client institutions and outside contacts alike can be targeted this way.

This exposure fits a database breach pattern, according to HEROIC analysts, meaning the records came directly from the company's own internal systems rather than from malware sitting on someone's personal device. A breach of this kind usually reflects a single point of compromise inside the organization's own infrastructure.

Confirm Your Exposure Now

Scan your email to see if it appears in this record set. If it does, be cautious of unexpected calls or messages referencing a bank, credit union, or lending relationship, and avoid confirming personal details to anyone who reaches out first. Consider changing the username associated with any related financial services logins.

This applies equally to personal and work email addresses, since business contacts at client institutions were also affected.