ShareFile Emergency: Shut Down Storage Zone Controllers Now

What happened

Progress Software has instructed ShareFile customers to shut down the Windows servers hosting their Storage Zone Controllers, citing what it describes as a "credible external security threat." According to reporting from The Hacker News (via feeds.feedburner.com), Progress has also temporarily disabled access to affected accounts "out of an abundance of caution" while it works through the incident with internal and external security teams.

At the time of the reporting, Progress had not published technical details — no CVE, no confirmed exploit path, and no public indicator list. What is clear is that the vendor itself is telling customers to take servers offline. That is not a routine patch advisory; that is an emergency posture, and it deserves an emergency response from anyone running Storage Zone Controllers on-premises.

Why this matters for Pittsburgh SMBs

ShareFile is heavily used by exactly the kinds of firms we serve across Western Pennsylvania: CPA and accounting practices moving tax workpapers and PBC lists, law firms exchanging discovery and closing binders, wealth managers sending statements, and healthcare and benefits shops moving PHI. If your firm adopted Storage Zone Controllers so that client files stay on a server you own — often for data-residency, retention, or compliance reasons — this advisory is aimed squarely at you.

A few concrete concerns for firms in the 10–200 employee range:

• Compliance exposure is not theoretical. If you're subject to the FTC Safeguards Rule (accounting, financial services), HIPAA (healthcare, some benefits and HR firms), the PA Breach of Personal Information Notification Act, or SOC 2 commitments to your own clients, an unaddressed vendor emergency involving a system that stores client data is a documentable failure of your incident-response and vendor-risk obligations.
• CMMC and defense contractors: if any CUI or FCI ever traversed a ShareFile Storage Zone, this touches your System Security Plan and your incident-reporting timelines to DoD.
• Client trust is local. Pittsburgh's professional-services market is tight-knit. A file-transfer breach at a firm your referrals know by name travels quickly.
• On-prem doesn't mean isolated. Storage Zone Controllers are Windows servers that talk to the ShareFile control plane over the internet. "It's behind our firewall" is not a control here.

Because Progress has not yet published a full technical writeup, we don't know whether this is remote code execution, credential compromise, data exfiltration, or something else. Treat the unknown as worst-case until the vendor confirms otherwise.

What to do about it this week

1. Identify every Storage Zone Controller you run. Include forgotten ones — test instances, DR nodes, servers stood up by a departed admin, and any hosted for you by a third party. Confirm hostnames, IPs, and who owns each.
2. Shut them down, as the vendor instructed. Power off or stop the Storage Zone Controller services on affected Windows servers. Don't just block inbound traffic; the vendor asked for shutdown. Preserve the VMs and disks as-is — do not rebuild yet — so forensic evidence is intact if you later need it.
3. Hunt before you assume you're clean. Pull Windows Event Logs, IIS logs, EDR telemetry, and firewall/egress logs for the Storage Zone servers going back at least 60–90 days. Look for unexpected outbound connections, new local accounts, scheduled tasks, web shells in the ShareFile web directories, and unusual PowerShell. If you don't have EDR on these servers, that itself is a finding.
4. Rotate secrets tied to the environment. Service accounts used by the Storage Zone Controller, any API keys, admin credentials, and passwords for accounts that authenticated to the appliance. Assume they may be exposed until Progress says otherwise.
5. Stand up a temporary file-exchange plan for clients. Most of our accounting and legal clients cannot simply stop moving files for a week. Have a documented interim workflow — encrypted email for small items, a vetted alternate portal for larger exchanges, and clear guidance to staff so they don't improvise with personal Dropbox or Gmail.
6. Open your incident-response playbook and start the clock. Notify your cyber-insurance carrier's hotline early — most policies require prompt notice, and their breach coach can be helpful even if this turns out to be nothing. If you're a covered entity or business associate, calendar your HIPAA 60-day assessment window. FTC Safeguards-covered firms should note the new 30-day FTC notification requirement for incidents affecting 500+ consumers.
7. Watch the vendor advisory page daily until Progress publishes a CVE, a patched build, and clear "safe to bring back online" guidance. Do not restore the servers based on rumor or a forum post — wait for the vendor's explicit all-clear and follow their remediation steps in order.

Also: verify with your team what data actually lived on those Storage Zones. You cannot make good notification decisions without knowing whose files were there.

How PGH Networks helps

If you're a PGH Networks client, we're already inventorying ShareFile Storage Zone Controllers across our managed environments, coordinating shutdowns, preserving logs, and helping affected firms communicate with clients and carriers. If you're not a client — or you run ShareFile outside of what we manage for you — we can help you triage today: identify exposure, execute a clean shutdown, hunt for signs of compromise, and stand up an interim secure file-exchange workflow that keeps your practice moving while Progress finishes its investigation. Call our Pittsburgh office at 724.888.7007 or reach your vCIO directly through our contact form if you run ShareFile Storage Zone Controllers — this one is time-sensitive.