INCIDENT REPORT · CP-2021-005

Kaseya VSA ransomware attack

L3 · ELEVATEDCONFIRMED

On 2 July 2021, attackers abused Kaseya's VSA remote management software to deploy REvil ransomware through managed service providers to their customers.

Incident ID: CP-2021-005
Incident date: 02 JUL 2021
Detection date: 02 JUL 2021
Affected countries: United States
Plotted location: Miami, United States (Affected software vendor headquarters (Kaseya))
Threat classification: Level 3 — ELEVATED
Classification rationale: Supply-chain ransomware hitting up to ~1,500 organizations across multiple sectors via MSPs.
Attack type: Supply-Chain Attack
Nature: Malicious activity
Attack vector: Exploitation of on-premises Kaseya VSA servers, using VSA product functionality to push ransomware to managed endpoints
Sectors: Technology, Education, Healthcare, Government
Critical infrastructure: No
Organizations affected: Kaseya, Managed service providers using Kaseya VSA, Downstream businesses of those providers
Operational consequences: Kaseya said fewer than 60 direct customers and fewer than 1,500 downstream businesses were affected, including schools, medical offices and local governments. REvil demanded $70 million for a universal decryptor.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by Kaseya and the US Department of Justice to REvil (Sodinokibi); DOJ charged Ukrainian national Yaroslav Vasinskyi in November 2021

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Kaseya VSA ransomware attack

L3 · ELEVATEDCONFIRMED

On 2 July 2021, attackers abused Kaseya's VSA remote management software to deploy REvil ransomware through managed service providers to their customers.

Incident ID

CP-2021-005

Incident date

02 JUL 2021

Detection date

02 JUL 2021

Affected countries

United States

Plotted location

Miami, United States (Affected software vendor headquarters (Kaseya))

Threat classification

Level 3 — ELEVATED

Classification rationale

Supply-chain ransomware hitting up to ~1,500 organizations across multiple sectors via MSPs.

Attack type

Supply-Chain Attack

Nature

Malicious activity

Attack vector

Exploitation of on-premises Kaseya VSA servers, using VSA product functionality to push ransomware to managed endpoints

Sectors

Technology, Education, Healthcare, Government

Critical infrastructure

Organizations affected

Kaseya, Managed service providers using Kaseya VSA, Downstream businesses of those providers

Operational consequences

Kaseya said fewer than 60 direct customers and fewer than 1,500 downstream businesses were affected, including schools, medical offices and local governments. REvil demanded $70 million for a universal decryptor.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by Kaseya and the US Department of Justice to REvil (Sodinokibi); DOJ charged Ukrainian national Yaroslav Vasinskyi in November 2021