Kaseya VSA attack (2021)
A July 2021 attack that, by compromising administration software used by managed service providers, spread ransomware to about 1,500 client companies in a single operation.
On July 2, 2021, the eve of a long weekend in the United States, the REvil group exploited a vulnerability in VSA, a remote monitoring and management product used by managed service providers to run their clients' systems. By hijacking the update tool, it deployed its ransomware at some sixty service providers and, through them, at up to 1,500 client companies, mainly small and midsize ones. The group then demanded 70 million dollars for a universal decryption key. The attack is the model of accumulation through managed services. An insurer that had diversified its small business portfolio by sector and region discovered that part of its insureds depended on the same tool, through different providers, and suffered the same attack on the same day. It also had a political sequel: a few days later, the US president publicly asked his Russian counterpart to act against groups operating from his territory, and REvil's site disappeared, a sign that the line between crime and relations between states is thin.
On 2 July 2021, in Sweden, the Coop supermarket chain had to close about 800 stores for several days, its checkouts depending on a provider that was itself a client of an affected managed service provider: a company that did not use the attacked software suffered one of the most visible business interruptions of the incident.
Kaseya, Kaseya VSA attack, REvil 2021
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.