[News](/news) Kaseya crippled by supply chain attack [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Kaseya crippled by supply chain attack ##### [Edward Kost](/team/edward-kost) July 4, 2021 The two largest threats to cybersecurity are supply chain attacks and ransomware attacks, but a combination of the two creates a new sinister breed of [cyber threat](https://www.upguard.com/blog/cyber-threat). The Russian ransomware gang REvil, inspired by the [SolarWinds wreckage caused by their comrades, SVR](https://www.upguard.com/news/u-s-government-data-breach), launched a [supply chain attack](https://www.upguard.com/blog/supply-chain-attack) to distribute their ransom software. The target was Florida-based  IT company [Kaseya](https://www.upguard.com/security-report/kaseya). REvil compromised Kaseya VSA servers and are currently using them to deploy and distribute their ransomware.  The ransomware encryptors are contained in the file *agent.exe. *When this file is activated, both an old yet legitimate, copy of Windows Defender *MsMpEng.exe, *and the encryptor payload *mpsvc.dll*. are dropped into the C:\Windows path to DLL sideload - a process where a malicious DLL file is loaded in place of a legitimate one. Several hundred organizations were impacted, including Kaseya VSA software customers and multiple Managed Service Providers (MSP) that use the VSA solution. Sweden suffered a heavy blow. State railways and a major pharmacy chain were affected, as well as 800 stores from the grocery chain Coop. The Cybersecurity & Infrastructure Security Agency (CISA) recommends impacted organizations follow [Kaseya’s advice](https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689) of immediately shutting down all VSA servers until further notice The [cyberattack](https://www.upguard.com/blog/cyber-attack) occurred on the Friday of the 4th of July holiday weekend, sparking speculation that the attack was motivated by political tensions rather than financial gain, [like most ransomware attacks](https://www.upguard.com/blog/what-is-ransomware-as-a-service). REvil is a family of ransomware developed by a Russian cybercriminal group. The ransomware is detected in antivirus scans as *Ransom.Sodinokibi. *REvil threat actors have achieved a reputation of launching some of the [most devastating ransomware attacks](https://www.upguard.com/news/acer-ransomware-attack) against high-profile organizations. Investigations are still ongoing, but the impact of this cyberattack is expected to be colossal.  Each confirmed victim so far provides services to customers, that might eventually discover that they’ve also been breached. Such a pernicious domino effect occurred with the [Accellion supply chain attack](https://www.upguard.com/news/kroger-data-breach). But unlike historical supply chain attacks, this one is very different. Victims are being infected with ransomware, where [sensitive data](https://www.upguard.com/blog/sensitive-data) is encrypted and only liberated if a ransom is paid, which, on [average costs $170,000](https://www.cpomagazine.com/cyber-security/ransomware-recovery-costs-more-than-double-in-a-year-now-average-1-85-million/#:~:text=There%20was%20also%20a%20mix,of%20%241.85%20million%20in%20total.). If victim behavior[ aligns with statistical trends](https://www.msspalert.com/cybersecurity-research/71-ransomware-victims-unable-to-restore-all-data/#:~:text=Approximately%2056%20percent%20of%20ransomware,by%20global%20security%20company%20Kaspersky.), almost half will pay a ransom, funding future attacks, and only 29% will restore their seized files, whether or not a ransom is paid. These figures, as disturbing as they are, only correspond to ransomware attack events. They could shift dramatically when the destructiveness of ransomware is coupled with the [pervasiveness of a supply chain attack](https://www.upguard.com/blog/supply-chain-attack). ## How secure is Kaseya? Kaseya provides IT management software and solutions for managed service providers and IT departments. The company offers a unified platform that includes endpoint management, backup and recovery, cybersecurity, compliance monitoring, networking tools, and IT operations automation. * View our free preliminary report on Kaseya’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Kaseya's score](/security-report/kaseya) [View score](/security-report/kaseya) [https://www.kaseya.com/](/security-report/kaseya) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)