Kaseya states that it was made aware of a security incident around noon on Friday, as a result they put its cloud services into maintenance mode and…
A hot potato: A ransomware attack has hit hundreds of businesses across the US, in a supply chain attack that targets Kaseya’s VSA system management platform (used for remote monitoring and IT management). While Kaseya claims less than 40 of over 36,000 customers were affected, the targeting of large managed service providers has led to vast numbers of clients further downstream being hit as a result. Kaseya states that it was made aware of a security incident around noon on Friday, as a result they put its cloud services into maintenance mode and issued a security advisory advising that all clients with a local VSA server to shut it down until further notice, as «one of the first things the attacker does is shutoff administrative access to the VSA.» Kaseya also notified the FBI and CISA as well as started its own internal investigation. The company’s second update stated that the shutdown of cloud VSA was done solely as a precaution, and that customers using their SaaS servers «were never at risk.» However, Kaseya also said that these services will remain suspended until the company determines it is safe to resume operations, and at the time of writing the cloud VSA suspension had been extended further to 9am ET.
