[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How Did Kaseya Get Hacked?](/blog/how-did-kaseya-get-hacked) Publish date November 19, 2024 {x} minute read # How Did Kaseya Get Hacked? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The Kaseya ransomware attack occurred through the exploitation of [CVE 2021-30116](https://nvd.nist.gov/vuln/detail/CVE-2021-30116), an authentication bypass vulnerability within Kaseya VSA servers. This allowed the hackers to circumvent authentication controls and executive commands via SQL injection, giving them all the control they needed to deploy their ransomware payload and encrypt a segment of Kaseya's internal data. In addition to compromising Kaseya's customer database, the hackers also targeted several of Kaseya's clients by pushing out the ransomware payload within a seemingly innocuous software update - a tactic that's synonymous with the advanced methods used in the [SolarWinds hack](https://www.upguard.com/news/u-s-government-data-breach). Kaseya was intentionally targeted because it offers IT solutions to Managed Service Providers (MSPs) offering IT support to under-resourced businesses. It's estimated that [almost 2000 businesses](https://cyberscoop.com/us-biden-ransomware-revil-kaseya/) across 17 counties were impacted by the attack. Many infections spread through firms remotely managing IT infrastructures for multiple customers, making this event the biggest supply chain ransomware attack on record. ## Who was Responsible for the Kaseya Ransomware Attack? Russian-linked ransomware gang REvil claimed responsibility for the attack on a dark web forum, boasting that over one million systems were infected with their ransomware. The ransomware gange also offered a decryption key to reinstate access to all seized systems for $70 million in cryptocurrency. REvil (also known as Sodinokibi) is the same cybercriminal gang likely responsible for the [mammoth Medibank data breach](https://www.upguard.com/blog/what-caused-the-medibank-data-breach).  ‍ See how your organization's security posture compares to Kaseya's.[\ \ View Kaseya's security report.](https://www.upguard.com/security-report/kaseya) ‍ ## How to Avoid an Incident like the Kaseya Ransomware Attack Your business could avoid falling victim to a security incident similar to the Kaseya Ransomware attack by adjusting your cybersecurity efforts to the following key learnings. ## 1. Expect to be Attacked During the Holidays The Kaseya ransomware attack occurred during the July 4th weekend. Cyberattacks, especially ransomware attacks,[ tend to spike over holiday periods](https://www.cisa.gov/uscert/ncas/alerts/aa21-243a), with hackers taking advantage of leaner staffing numbers during the lull of business demand.  With fewer IT and security staff on call, cyber threats are harder to intercept and contain after a network breach. Less security staff also makes it harder to support staff contending with a potential phishing threat - [the primary initial attack vector for ransomware](https://www.upguard.com/blog/cost-of-data-breach). Implementing a zero-trust architecture will keep your cybersecurity program primed for imminent data breaches at all times, even while you're mentally unplugged on that long-awaited holiday.  [Learn more about Zero Trust >](https://www.upguard.com/blog/zero-trust) ## 2. Download the Kaseya VSA Detection Tool With the impact of this attack specifically designed to proliferate across the supply chain, it's difficult to predict how far REvil's indicators of compromise have spread and how many systems are still vulnerable to compromise, despite this incident occurring in July 2021. The presence of any indicators of compromise linked to this ransomware attack can be detected with this [Kaseya VSA detection tool](https://kaseya.app.box.com/s/0ysvgss7w48nxh8k1xt7fqhbcjxhas40). If you have a scanning solution in place, update it to include [this list of CNC domains](https://github.com/pgl/kaseya-revil-cnc-domains/blob/main/revil-kaseya-cnc-domains.txt) believed to be linked to Kaseya. ## 3. Implement Controls for Reducing the Impact of Ransomware Attacks By implementing security controls across all of the major milestones of a ransomware attack pathway, the progression of an attack could be stopped or, at the very least, slowed down enough to be intercepted before sensitive resources are breached. The ransomware attack lifecycle can be broken down into eight primary phases. * **Phase 1 - **Phishing Attack * **Phase 2 - **Victim Interaction * **Phase 3 - **Account Compromise  * **Phase 4 - **Privilege Escalation** ** * **Phase 5 - **Lateral Movement * **Phase 6** - Data Exfiltration * **Phase 7 - **Data Encryption * **Phase 8** - Data Dump A list of suggested security controls corresponding to each of the phases are as follows: #### **Phase 1 - **Phishing Attack **Security controls:** * Security awareness training. #### **Phase 2 - **Victim interaction **Security controls:** * Web proxy * DNS Logs * Endpoint Security #### **Phase 3 - **Account Compromise **Security controls:** * Multi-Factor Authentication #### **Phase 4 - **Privilege Escalation **Security controls:** * Privileged Escalation Management * Zero-Trust Architecture * Password Manager * Multi-Factor Authentication #### **Phase 5 - **Lateral Movement **Security controls:** * SIEM * Zero Trust * Data Loss Prevention #### **Phase 6 - **Data Exfiltration **Security controls:** * Network Segmentation * Privileged Access Managemen * Data Encryption #### **Phase 7 - **Data Encryption **Security controls:** * Data backups #### **Phase 8 - **Data Dump **Security controls:** * Ransomware blog data leak detection. [Learn how to secure the ransomware attack pathway >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 26, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)