Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the tools their IT providers used to manage them. Clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On Friday, July 2, 2021, the start of the US Independence Day weekend, the REvil ransomware group exploited a previously unknown vulnerability in on-premises installations of Kaseya VSA. VSA is a remote monitoring and management tool widely used by managed service providers (MSPs). The attackers used VSA’s own software deployment function to push ransomware to computers those providers managed. Kaseya told customers to shut down on-premises VSA servers at once and took its cloud service offline as a precaution. The Dutch Institute for Vulnerability Disclosure had already reported the flaw to Kaseya, which was working on a fix. Kaseya later estimated that about 50 to 60 of its direct customers, mostly MSPs, were compromised, and fewer than 1,500 downstream organizations affected. In Sweden, the Coop grocery chain closed most of its stores for days. REvil demanded $70 million for a universal decryptor.
Most of the organizations hit through Kaseya had never heard of VSA. They were dental practices, accounting firms, schools, municipalities and small manufacturers that paid a provider to run their IT precisely so they would not need to understand its tools. That arrangement moves work. It does not move accountability. A client’s data, operations and regulatory duties stay with the client, while the most powerful software in its environment is chosen, configured and patched by someone else. The attack exposed three gaps in that arrangement, which we take in order: privilege, what the provider’s tooling can do inside the client; concentration, how one tool’s failure spreads across many clients at once; and contract, what the agreement says about either.
Privilege: the agent that outranks your administrators
A remote monitoring and management platform works by installing an agent on every managed laptop and server. The agent usually runs with full system rights and takes instructions from a central console that can push software, run scripts and change settings across every device. That is the product working as designed. It also means the console holds more effective authority over a client’s estate than any administrator account the client itself controls.
Few clients treated it that way. A bank or health system that runs its own IT will typically require multi-factor authentication for domain administrators, log their actions and review them. The same organization may let a provider reach every endpoint through a console it has never seen, with security controls it has never asked about. In the Kaseya case the attackers did not need anyone’s password. They exploited the on-premises VSA server itself and then used the trusted deployment channel, so the ransomware arrived as an ordinary management task, and endpoint tools that trusted the agent did not stop it.
Closing the gap starts with an inventory question that most third-party risk programs did not ask in 2021: which external tools hold privileged, persistent access to our systems? The answer usually includes the MSP’s monitoring platform, remote support tools, backup agents, endpoint security consoles run by a provider, and vendor support accounts. Each belongs on the same list as the client’s own privileged accounts, with the same expectations: strong authentication to the console, restricted network exposure, a record of what it executes, and an owner on the client side who reviews that record.
Concentration: one console, many clients, one weekend
The second gap is structural. A handful of management products serve a large share of MSPs, and each MSP serves dozens or hundreds of clients. A flaw in one product therefore travels through a few intermediaries to a very large number of organizations simultaneously. Kaseya’s own estimate, a few dozen direct customers and up to roughly 1,500 downstream organizations, shows the multiplier.
Concentration also changes the recovery. A provider with one compromised client can send its best engineers. A provider with forty compromised clients on a holiday weekend has to triage, and some clients will wait. REvil chose its timing with that in mind. Clients that assumed their provider would respond as if they were its only customer found out otherwise.
An individual client cannot remove this concentration, but it can see it and plan for it. The useful questions for a provider are concrete. Is the management platform self-hosted or vendor-hosted, and who patches it? Is our environment managed from a console instance shared with other clients, or a separate one? If the platform is compromised, how will you rank clients for response, and where do we sit? Providers that segment their management infrastructure, separating clients or groups of clients so one breach cannot reach all of them, reduce the blast radius for everyone. A client that cannot get answers to these questions has learned something about its provider.
Contract: what the agreement does not say
The third gap sits in the paperwork. Many managed services agreements in 2021 described uptime, ticket response times and pricing in detail and said almost nothing about the security of the provider’s own tools. Typical omissions included any duty to notify the client when the provider itself is compromised, any right to see the provider’s security assessments, any allocation of recovery costs, and any statement of which party decides to disconnect a management agent in an emergency. Clients often assumed the provider was responsible for security in general. The agreements rarely said so.
For regulated clients, this is a compliance gap as well as a commercial one. Banks and credit unions are expected to manage the risk of technology service providers under supervisory third-party guidance. Health care organizations whose provider can reach systems holding protected health information generally need a business associate agreement, and the provider’s management platform is part of how that information could be exposed. Agencies whose systems hold criminal justice information must extend CJIS Security Policy requirements to contractors with access. In each case the provider’s tooling is in scope, and the contract should say so in terms an auditor can test. Organizations should check with counsel on the specific obligations that apply.
Useful clauses are specific: notice of a provider-side security incident within a defined number of hours; an annual independent assessment of the provider’s management environment; multi-factor authentication and logging on any console that reaches the client; client rights to the console’s activity logs for its own environment; named contacts reachable on weekends and holidays; and a stated right for the client to disconnect agents without penalty. None of these prevents a zero-day. Together they decide whether the client hears about a compromise from its provider within hours or from its own staff on Tuesday morning.
The three gaps compound. Privilege makes a compromise severe, concentration makes it simultaneous, and a thin contract makes the response slow and disputed. A client that addresses only one of them still carries the other two.
With hindsight
Looking back from 2026, Kaseya remains the reference case for attacks that travel through IT service providers. Kaseya obtained a universal decryptor later in July 2021 and distributed it to affected customers, and REvil’s infrastructure went offline that month. A Ukrainian national charged over the attack was arrested in Poland in October 2021, extradited to the United States and sentenced in 2024. In May 2022, cybersecurity agencies of the Five Eyes countries issued joint guidance on protecting MSPs and their customers, much of it about the privilege and segmentation issues above. Attackers kept targeting remote access and management tools, including a widely exploited flaw in ConnectWise ScreenConnect in early 2024. Regulators moved the same way: the EU’s Digital Operational Resilience Act, applied from January 2025, brought ICT service providers squarely into financial entities’ contractual and oversight duties. The durable finding is the narrow one: a provider’s management console is part of the client’s attack surface and has to be governed as such.