In July 2021 attackers used an IT management tool to push ransomware to its customers' computers. A Swedish grocer that never bought the tool shut most of its stores. No plant was touched. The mechanism reaches plants.
Kaseya is an IT compromise halting physical operations at two removes: nothing in the record reached an industrial process; what stopped was Coop’s tills, self-checkouts and scales, at a chain never Kaseya’s customer, only its IT supplier’s. No party has published a root cause. BlastWave’s reading, not a disclosed fact: an internet-reachable management server, with standing authority to run code on every managed endpoint, unpatched on-premises after the cloud fix. The record does not support calling Kaseya careless: the researchers who reported the flaw called it very cooperative.
It is here for its mechanism. A plant whose integrator keeps a remote support agent on HMIs and engineering stations has the same arrangement: a standing right to execute, held outside the fence. That too is BlastWave’s analysis. Coop was softened by a payment app that, on our reading, bypassed the tills. The plant question: when the managed estate goes dark, what runs?
What is not known: Kaseya’s figures are ceilings, fewer than 60 customers and fewer than 1,500 businesses; no count of encrypted firms exists, and REvil’s million systems is a claim. The second flaw used is officially unnamed; how the attackers learned of the flaws is not public. Coop said most of its roughly 800 stores closed, not how many. No one affected has published a cost. How the decryptor was obtained rests on press reports. Nothing in the record places a VSA agent on an industrial control system.
Recommendation
Take the path away No remote management console, a provider’s or your own, answers from the internet. At a plant, outside management arrives only through a path the site owns and can close.
Remove standing authority to execute Nothing gating production (till, HMI, engineering station) runs third-party code on the sender’s schedule. Changes arrive in an approved window, from a named identity.
Monitor one way; run without it Health and inventory data leave the site one way, with no write path back. Keep a way to operate without the managed estate, and exercise it before it is needed.
Sources: Kaseya incident updates, 2 Jul to 4 Aug 2021; DIVD, 4 and 7 Jul 2021; CISA-FBI guidance for MSPs, 4 Jul 2021; DOJ, 8 Nov 2021; KF Annual Report 2021; AA22-131A, 11 May 2022. Full list with links.
Soft Spots: Every Kaseya count is a ceiling, not a count of encrypted businesses. The Coop store count is press. The root cause (no party has published one), the plant parallel and the app bypassing the tills are BlastWave’s reading.
The full record
Every claim numbered to its source. Last updated .
Attackers used an IT management tool to push ransomware to the computers it managed, and a Swedish grocer that never bought the tool shut most of its stores. What is verified, what is only reported, and what is still unknown.
Summary
On 2 July 2021, attackers used vulnerabilities in on-premises servers running Kaseya's VSA remote management software to push REvil ransomware to the computers those servers managed. Kaseya said fewer than 60 customers and fewer than 1,500 downstream businesses were affected, both ceilings. In Sweden, Coop closed most of its roughly 800 stores. No industrial control system is in the record.1,2,3,10
Timeline of the Kaseya VSA attack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The Dutch Institute for Vulnerability Disclosure (DIVD) informs Kaseya of vulnerabilities in VSA.5
Kaseya releases VSA 9.5.5 and 9.5.6, fixing several of the reported flaws.5
VSA 9.5.7 reaches cloud (SaaS) customers, resolving CVE-2021-30116 and CVE-2021-30119. On-premises servers are not yet patched.5
Kaseya posts its first notice of "a potential attack against the VSA" and tells customers to shut down their VSA servers immediately.1
Coop Sweden's tills start failing that evening, at about 7 p.m. by the company's account to reporters.13
Kaseya puts the affected customers at fewer than 40 worldwide.1
The FBI issues a statement on the attack (updated 4 July). President Biden says the initial thinking was that it was not the Russian government, "but we're not sure yet." Most Coop stores are closed.10,14,15
CISA and the FBI publish guidance for managed service providers and their customers. DIVD reports that internet-reachable VSA instances have dropped from over 2,200 to fewer than 140.16,17
Kaseya's incident page gives "fewer than 60 Kaseya customers" and "fewer than 1,500 downstream businesses"; its 5 July press release says "approximately 50" and "about 800 to 1,500." The Record reports REvil's blog claim of the attack and its USD 70 million demand.1,4,7
DIVD publishes its limited disclosure. About 500 of Coop's 800 stores are open again.5,10
Kaseya reports all of its SaaS customers live again.1
Kaseya obtains a decryptor "from a third party" on 21 July and announces it on 22 July.1
Kaseya states it did not pay a ransom, "either directly or indirectly through a third party."1
The Washington Post reports that the FBI held a decryption key for almost three weeks. The same day, the FBI Director defends the handling in general terms before a Senate committee.18,19
CVE-2021-30116 is added to CISA's Known Exploited Vulnerabilities catalog.6
The Justice Department announces charges against Yaroslav Vasinskyi, alleging he was responsible for the attack.2
Vasinskyi is extradited to the United States and arraigned in Texas.20
CISA and partner agencies publish advisory AA22-131A on cyber threats to managed service providers and their customers.21
Vasinskyi, having pleaded guilty to the 11-count indictment, is sentenced to 13 years and 7 months. The sentencing release does not mention Kaseya.8
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What did Kaseya tell customers first?
Shut down VSA servers immediately (2 July 2021, 4:00 p.m. EDT)1
Verified
How did the ransomware reach managed computers?
Through the product's own deployment function, per the Justice Department2
Verified (DOJ account)
How many were affected?
Fewer than 60 Kaseya customers and fewer than 1,500 downstream businesses, per Kaseya. Ceilings, not counts1
Verified (ceilings)
Was the flaw reported before the attack?
Yes. DIVD informed Kaseya on 6 April 2021; the cloud fix shipped 26 June; on-premises servers were not yet patched5
Verified
What was the second vulnerability used?
Not officially identified. DIVD names only the one it disclosed5
Undisclosed
Who carried it out?
Claimed by REvil; the Justice Department charged Yaroslav Vasinskyi, who later pleaded guilty to the indictment2,7,8
A majority of roughly 800, per Coop; about 500 per the BBC as reported13
Reported only
Was any industrial control system reached?
Nothing in the record places a VSA agent on one2,3
Verified (time-bound)
Was a ransom paid?
Kaseya says no, "either directly or indirectly through a third party"1
Verified (Kaseya statement)
Who supplied the decryptor?
"A third party," per Kaseya. The FBI's role rests on press reporting1,18
Reported only
What did it cost?
Not published by Kaseya, Coop or anyone affected
Undisclosed
Why did Coop Sweden close its stores after the Kaseya attack?
Because the tills, self-checkouts and scales in its stores stopped working, and Coop was never Kaseya's customer: its IT supplier was. Coop's IT supplier, Visma Esscom, used Kaseya VSA, according to Coop's spokesperson as reported by RTÉ.22 Coop's parent, Kooperativa Förbundet (KF), recorded the effect in its 2021 annual report:
"butiker inte längre kunde använda sina kassor, Shopexpress, vågar med mera och därmed tvingades hålla stängt"
In English: stores could no longer use their tills, their Shopexpress self-checkouts, their scales and more, and were therefore forced to stay closed. KF describes the cause as a ransomware attack against a third-party supplier, and records that compensation claims were brought against the supplier of its checkout system and against its insurer.3
How many stores closed is press, not company arithmetic. Coop said a majority of its roughly 800 stores were affected; the BBC was reported as putting it at about 500.13 Swedish trade press records most stores closed from 3 July, about 500 of 800 open again on 7 July, and all open on 8 July.10 Eight hundred is the size of the chain, not the number of closures.
What softened the outage was not detection. KF's annual report says its Scan & Pay phone app, already in several stores and rolled out quickly to many more, partly reduced the economic consequences.3 That the app helped because it did not depend on the tills is BlastWave's reading, not KF's statement.
Did the Kaseya attack reach any industrial control system?
Not on the record. Nothing in the record places a VSA agent on an industrial control system. What stopped was retail: tills, self-checkouts and scales at Coop,3 and, according to press reports, schools and kindergartens in New Zealand, where kindergartens were reported to have switched to pen and paper.11,12 No OT compromise was reported anywhere, as of the sources read for this entry in late September 2026.
On Hackopedia's consequence ladder, Kaseya sits on the rung for IT compromise halting physical operations: a managed-service compromise, at two removes. It appears in an operational technology reference for its mechanism, not its victims, and that argument is BlastWave's analysis, not a disclosed fact. It is set out in the analysis below.
How did the attackers get into Kaseya VSA?
Through vulnerabilities in internet-facing on-premises VSA servers; the full exploit chain has not been set out by Kaseya or any government. The flaw was not a secret. DIVD informed Kaseya of a set of vulnerabilities on 6 April 2021. Kaseya released fixes on 10 April and 8 May, and version 9.5.7, resolving CVE-2021-30116 and CVE-2021-30119, reached cloud (SaaS) customers on 26 June. The on-premises servers were still unpatched when the attack came six days later.5
"one of the two vulnerabilities used in the attack was one we previously disclosed"
The National Vulnerability Database describes CVE-2021-30116 as follows: "Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021."6 It is the only CVE NVD marks as exploited. DIVD does not name the second vulnerability in its publication, and how the attackers found the flaw is on no record.
The record does not support calling Kaseya careless. DIVD wrote on 4 July 2021 that Kaseya "has been very cooperative."17 The gap was between a cloud fix that had shipped and an on-premises fix that had not.
Once inside, the product did what it was built to do. The Justice Department said malicious code:
"caused the Kaseya production functionality to deploy REvil ransomware to 'endpoints'"
The execution detail comes from one vendor's analysis. Sophos researchers describe the agent switching off Microsoft Defender protections with a PowerShell command, then running the ransomware by side-loading a DLL into an outdated, Microsoft-signed Defender executable, with "no sign of deletion of volume shadow copies."9
How many businesses were hit by the Kaseya attack?
No exact count exists. Kaseya said fewer than 60 direct customers and fewer than 1,500 downstream businesses, and both figures are ceilings. The numbers moved as Kaseya learned more: fewer than 40 customers worldwide at 10:00 p.m. EDT on 2 July; "fewer than 60 Kaseya customers" and "fewer than 1,500 downstream businesses" on its incident page on 5 and 6 July.1 Its press release on 5 July said "approximately 50 of the more than 35,000 Kaseya customers" and "about 800 to 1,500" downstream businesses.4
None of these is a count of encrypted businesses or machines. REvil's own blog claimed more than a million systems; that is a claim by the party selling the decryptor.7 Later trade coverage turned Kaseya's ceiling into a floor, describing the attack as one that "impacted over 1,500 organizations."23 Accurate wording is "up to" or "fewer than" 1,500, attributed to Kaseya.
Who was behind the Kaseya attack, and was the ransom paid?
REvil claimed it; the Justice Department charged one man, who later pleaded guilty; no government has attributed it to a state. REvil claimed the attack on its leak blog and demanded USD 70 million.7 On 8 November 2021 the Justice Department alleged that Yaroslav Vasinskyi, a Ukrainian national arrested in Poland, was responsible for the attack.2 He was extradited and arraigned in Texas in March 2022.20 He pleaded guilty to the 11-count indictment and on 1 May 2024 was sentenced to 13 years and 7 months, with over $16 million in restitution; the sentencing release does not mention Kaseya.8 The link from that plea to this attack runs through the 2021 charging documents.
"The initial thinking was it was not the Russian government but we're not sure yet."
Kaseya says it paid no ransom, "either directly or indirectly through a third party," and that it obtained a decryptor "from a third party" on 21 July 2021.1 That the FBI had held a key for almost three weeks is Washington Post reporting from 21 September 2021.18 The same day, the FBI Director told a Senate committee in general terms that such decisions were complex, case specific and made as a group.19 The document trail stops there.
What is still not known about Kaseya VSA
The exact number of businesses or machines encrypted. Kaseya's figures are ceilings: fewer than 60 customers and fewer than 1,500 businesses. REvil's "more than a million systems" is a claim.1,7
The second vulnerability used in the attack, which is not officially identified, and how the attackers learned of the flaw.5
How many Coop stores closed. Coop said a majority of its roughly 800, not how many.13
The cost to Kaseya, Coop or any other affected business. No one affected has published one.
How the third party obtained the decryptor. The FBI's role rests on press reporting.18
Whether the timing was chosen. The attack fell on the last working day before the US Independence Day weekend; that this was deliberate is inference, and no document states it.
Whether any VSA agent sat on an industrial control system. Nothing in the record places one there.
Claims about Kaseya VSA the record does not support
Widely repeated claim
What the record says
"The Kaseya attack impacted over 1,500 organizations."
Kaseya said "fewer than 1,500 downstream businesses," a ceiling, and its press release said about 800 to 1,500. No count of encrypted businesses exists.1,4,23
"More than a million systems were infected."
A claim on REvil's own blog, by the party selling the decryptor. Kaseya's own ceilings are fewer than 60 customers and fewer than 1,500 businesses.1,7
What did US agencies advise after the Kaseya attack?
CISA and the FBI told providers to take management interfaces off the open internet and to stop automatic patching. The FBI issued a statement on 3 July 2021, updated 4 July.14 Their joint guidance of 4 July 2021 asked that remote monitoring and management administrative interfaces sit "behind a virtual private network (VPN) or a firewall on a dedicated administrative network," and told customers to "revert to a manual patch management process."16
CVE-2021-30116 was added to CISA's Known Exploited Vulnerabilities catalog on 3 November 2021.6 On 11 May 2022, CISA and partner agencies published AA22-131A, "Protecting Against Cyber Threats to Managed Service Providers and their Customers."21
BlastWave analysis: a standing right to execute, held outside the fence
Analysis, not a disclosed fact
Remote monitoring and management exists to run code on every machine it manages without asking each one. On 2 July 2021 that authority was used by someone who did not own it, and the payload went out through the product's own deployment function.2 No party has published a root cause. BlastWave's reading, not a disclosed fact: a management server reachable from the internet, with standing authority to run code on every managed endpoint, unpatched on-premises after the cloud fix had shipped. The flaw had been reported in April by researchers who called the company very cooperative, and the cloud fix had gone out six days earlier; the on-premises servers were the gap.5,17
A plant whose integrator keeps a remote support agent on its HMIs and engineering stations has the same arrangement: a standing right to execute, held outside the fence. That too is BlastWave's analysis, not a disclosed fact. And the plant version of Coop's lesson is the same question: when the managed estate goes dark, what still runs? For Coop, by its parent's account, it was a payment app already in some stores and rolled out quickly to many more.3
Podcast: “The Pest Control Route” (9:11). Joe Baxter and Cam Cullen on why the question at a plant is not whether your integrator is careful but whose code your machines will accept without asking.
Video: Kaseya VSA Short (60 to 90 seconds).
Frequently asked questions
What happened in the Kaseya VSA ransomware attack?
On Friday 2 July 2021, attackers exploited vulnerabilities in internet-facing on-premises servers running Kaseya's VSA remote management software. The Justice Department said malicious code caused the product's own deployment function to push REvil ransomware to managed computers on customer networks. Kaseya told customers at 4:00 p.m. EDT to shut down their VSA servers immediately, released an on-premises patch on 11 July and had all cloud customers live again on 12 July.
How many companies were affected by the Kaseya attack?
No exact count exists. Kaseya's incident page said on 5 and 6 July 2021 that fewer than 60 Kaseya customers and fewer than 1,500 downstream businesses were affected; its 5 July press release said approximately 50 customers and about 800 to 1,500 businesses. These are ceilings, not counts of encrypted businesses. REvil's claim of more than a million systems is an attacker's claim.
Why did Coop Sweden close its stores?
Coop was not a Kaseya customer; its IT supplier used Kaseya VSA. Coop's parent, KF, wrote in its 2021 annual report that stores could no longer use their tills, self-checkouts and scales and were forced to stay closed. Coop said a majority of its roughly 800 stores were affected. Swedish trade press reported most closed from 3 July 2021 and all open again by 8 July.
Did the Kaseya attack affect industrial control systems or factories?
No industrial control system appears in the record. What stopped was retail checkout, self-scan and weighing at Coop Sweden, and, according to press reports, schools and kindergartens in New Zealand. BlastWave includes the incident in its operational technology reference because the same arrangement, an outside party with a standing right to run code on managed computers, exists at many plants. That is BlastWave's analysis, not a disclosed fact.
Who was behind the Kaseya attack?
REvil, also known as Sodinokibi, claimed the attack on its blog and demanded USD 70 million. In November 2021 the Justice Department alleged that Yaroslav Vasinskyi was responsible. He later pleaded guilty to the 11-count indictment and was sentenced on 1 May 2024 to 13 years and 7 months; the sentencing release does not mention Kaseya. No government has attributed the attack to a state.
Did Kaseya pay the ransom, and where did the decryptor come from?
Kaseya stated on 26 July 2021 that it did not pay a ransom, either directly or indirectly through a third party. It said it obtained a decryptor from a third party on 21 July 2021. The Washington Post reported on 21 September 2021 that the FBI had held a decryption key for almost three weeks; that account is press reporting, not a published government document.
Did Kaseya ignore the vulnerability warning?
The record does not support that. The Dutch Institute for Vulnerability Disclosure informed Kaseya on 6 April 2021 and wrote that Kaseya had been very cooperative. Kaseya released fixes in April and May, and the fix for the flaw later listed as exploited reached cloud customers on 26 June. On-premises servers were not yet patched when the attack came on 2 July.
Primary sources are Kaseya's own dated incident updates and press release, Justice Department releases, federal advisories, the disclosing researchers' publications and the annual report of Coop's parent. Vendor analysis is cited for technical detail only, and press only as evidence of what was said.
CompanyKaseya, "Important Notice July 2nd, 2021," incident updates dated 2 July to 4 August 2021 (the article was later retitled "Important Notice August 4th, 2021"). helpdesk.kaseya.com
FederalUS Department of Justice, "Ukrainian Arrested and Charged with Ransomware Attack on Kaseya," 8 November 2021. justice.gov
Company filingKooperativa Förbundet (KF), Årsredovisning 2021 (Annual Report 2021): CEO's comment, p. 3; Väsentliga händelser (significant events), p. 7. PDF
CompanyKaseya, press release, "Kaseya Responds Swiftly to Sophisticated Cyberattack, Mitigating Global Disruption to Customers," 5 July 2021. kaseya.com · Wire copy
ResearcherDIVD CSIRT, Frank Breedijk, "Kaseya VSA Limited Disclosure," 7 July 2021 (case DIVD-2021-00002). csirt.divd.nl
FederalNIST National Vulnerability Database, CVE-2021-30116, including its CISA Known Exploited Vulnerabilities entry (added 3 November 2021). nvd.nist.gov
PressThe Record, report quoting REvil's blog post and its USD 70 million demand, 5 July 2021. Cited as evidence of what was said. therecord.media
FederalUS Department of Justice, "Sodinokibi/REvil Affiliate Sentenced for Role in $700M Ransomware Scheme," 1 May 2024. justice.gov
ResearcherSophos, Mark Loman, Sean Gallagher and Anand Ajjan, "Independence Day: REvil uses supply chain exploit to attack hundreds of businesses," 2 July 2021 (updated). A vendor analysis, cited for execution detail only. sophos.com
PressDagens Handel, "Alla Coopbutiker öppna igen: hackerattacken dag för dag," 8 July 2021. Cited as evidence of what was said. dagenshandel.se
PressRNZ, report on New Zealand kindergartens hit by the Kaseya ransomware attack, 5 July 2021. Cited as evidence of what was said. rnz.co.nz
PressNZ Herald, report on New Zealand schools hit by the attack, July 2021. Cited as evidence of what was said. nzherald.co.nz
PressBleepingComputer, "Coop supermarket closes 500 stores after Kaseya ransomware attack," 3 July 2021, quoting Coop and reporting the BBC's figure. Cited as evidence of what was said. bleepingcomputer.com
FederalFBI, "FBI Statement on Kaseya Ransomware Attack," 3 July 2021, updated 4 July 2021. fbi.gov
PressUPI, report on the Kaseya attack including President Biden's remarks in Michigan, 3 July 2021. Cited as evidence of what was said. upi.com
FederalCISA and FBI, "CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack," 4 July 2021. PDF (ic3.gov) · cisa.gov
ResearcherDIVD CSIRT, "Kaseya Case Update 2," 4 July 2021. csirt.divd.nl
PressThe Washington Post, Nakashima and Lerman, report that the FBI held back the REvil decryption key, 21 September 2021. Cited as evidence of what was said. washingtonpost.com
Sworn testimonySenate Committee on Homeland Security and Governmental Affairs, "Threats to the Homeland: Evaluating the Landscape 20 Years After 9/11," 21 September 2021 (S. Hrg. 117-264): testimony of the FBI Director. C-SPAN recording
FederalUS Department of Justice, "Sodinokibi/REvil Ransomware Defendant Extradited to United States and Arraigned in Texas," 9 March 2022. justice.gov
FederalCISA and partner agencies, Joint Cybersecurity Advisory AA22-131A, "Protecting Against Cyber Threats to Managed Service Providers and their Customers," 11 May 2022. cisa.gov
PressRTÉ, report on the Coop closures, 3 July 2021, quoting Coop spokesperson Therese Knapp to SVT. Cited as evidence of what was said. rte.ie
PressSecurityWeek, Ionut Arghire, report on the sentencing of the REvil affiliate, 3 May 2024. Cited as evidence of what was said. securityweek.com
Cite this page
BlastWave. “Kaseya VSA Supply-Chain Ransomware Attack (2021): What Is Verified.” Hackopedia, Volume 2, FILE 012. Last verified 28 September 2026. https://hackopedia.blastwave.com/food-beverage-retail/kaseya-vsa-2021/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 012 in Hackopedia Volume 2, in the Food, Beverage and Retail edition.
28 Sep 2026
Hand-check at source: the Washington Post's 21 September 2021 report, the FBI Director's Senate testimony of the same day, New Zealand press reports on schools and kindergartens, the title and date of advisory AA22-131A and SecurityWeek's "over 1,500" wording were each confirmed. Consistency review against the Target, Havex and Collins Aerospace entries.
26 Sep 2026
Full validation of every figure, date and quotation against Kaseya's incident updates and press release, DIVD, NVD, the Justice Department and KF's annual report. Coop's closure timeline narrowed (most stores were open again by 7 July); the second vulnerability described as not officially identified rather than not public; Root Cause set to Undisclosed, with BlastWave's reading moved to the analysis and labeled; Defender and DLL execution detail attributed to Sophos researchers.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
