Kaseya: when one supplier hit a thousand businesses at once

About this series

The July 2021 Independence Day attack

On July 2, 2021, just as many businesses in the U.S. were heading into the Independence Day holiday weekend, a massive Ransomware (show definition) attack began. The targets weren't just big corporations; they were thousands of small and mid-sized businesses around the world.

The attackers, a group known as REvil, didn't hack each of these 1,500 businesses individually. Instead, they exploited a vulnerability in a software tool called Kaseya VSA. This tool is used by Managed Service Providers (MSPs)—the IT companies that many small businesses hire to manage their computers and servers.

By compromising the VSA tool, the attackers were able to push malicious updates directly to the computers of every business managed by those IT providers. It was a classic supply-chain attack: hit the provider to reach the customers.

The risk of the trusted connection

The Kaseya incident highlighted a paradox in modern business security. To stay secure and efficient, small businesses outsource their IT to experts. But that expert now has a 'master key' to your network. If the expert's tools are compromised, you are at risk.

This is known as concentration risk. Because Kaseya was used by so many IT providers, it was a high-value target. A single success for the attackers allowed them to lock up grocery stores in Sweden, schools in New Zealand, and hundreds of small offices in the United States.

Patching and speed

The vulnerability used in the attack was a 'zero-day,' meaning it was previously unknown to the software maker. However, Kaseya was already working on a fix when the attack started. The attackers moved faster than the update could be deployed.

For a business owner, this emphasizes the importance of a fast Patching (show definition) cadence. While you cannot protect against every unknown flaw, ensuring that your systems are updated as soon as a fix is available reduces the window of opportunity for criminals.

Managing your IT vendor risk

You don't need to be a technical expert to manage this risk, but you do need to ask the right questions of your IT partners. A good provider should be transparent about the tools they use and how they protect their own access to your systems.

1. Ask your IT provider which remote management tools they use and how they are secured.
2. Verify that your provider uses Multi-factor authentication (MFA) (show definition) for every technician who can access your network.
3. Confirm that they have a plan for what happens if their own tools are compromised.
4. Ensure your backups are 'immutable' or air-gapped, so an attacker using a management tool can't delete your recovery options.

The aftermath and the lesson

In late 2021 and early 2022, several members of the REvil group were arrested by international law enforcement. While these arrests were a victory, the damage was already done. Many businesses spent weeks recovering from the encryption.

The lesson is clear: your security boundary doesn't end at your front door. It extends to every vendor and software provider you trust. Regular reviews of these vendors are not just a bureaucratic chore; they are a fundamental part of protecting your business.