The Kaseya Incident: A Classic Case

The incident involving Kaseya in July 2021 is often cited as a classic example of a digital supply chain attack. Yet, in discussions with executives and CISOs, it's clear that the full impact and lessons learned have not always fully resonated.

Kaseya is an American software company that provides management solutions to Managed Service Providers (MSPs). These MSPs, in turn, manage IT environments for hundreds, sometimes thousands, of organizations, including many mid-sized companies in the Netherlands. It was precisely this position in the chain that made Kaseya an attractive target.

The attack did not primarily target Kaseya itself, but rather the trust relationship between Kaseya, the MSP, and the end customer. This immediately revealed how far the digital supply chain extends, often further than executives realize. The incident demonstrates that cyber risks do not stop at one's own firewall or IT department but accumulate with suppliers, software developers, and service providers deeply integrated into business operations.

What Happened Technically, Without Jargon

The attackers exploited a vulnerability in Kaseya VSA, a management tool that allows MSPs to remotely monitor and manage customer systems. Such a tool inherently has extensive privileges, as it cannot function otherwise. The criminals used this vulnerability to distribute malicious software that was automatically rolled out to end-customer systems.

This type of attack is called ransomware: files are encrypted and only released after a ransom payment. The ransomware used originated from the group REvil, at the time one of the most professional cybercriminal networks. It's important to understand that no end organization had to “do anything wrong.” The attack leveraged legitimate software and existing management channels. For executives, this is confronting: even well-structured organizations with robust security measures can be affected through their suppliers, without direct prior warning.

The Impact: From IT Disruption to Business Stoppage

The consequences of the Kaseya incident were significant. An estimated 1,500 organizations worldwide were affected. In Europe, the temporary closure of supermarkets garnered significant media attention, but manufacturing companies, accounting firms, and logistics service providers also experienced days of downtime.

For mid-sized organizations, this often meant more than just IT problems. Order processing halted, invoicing was delayed, and customer trust was undermined. In the Netherlands, we observed that companies were dependent on their MSP for recovery, while that same MSP was itself a victim. This created a sense of powerlessness among executives: they could not intervene but had to wait. The incident painfully highlighted that continuity depends not only on internal processes but on the resilience of the entire chain. Financial damage, reputational harm, and governance questions quickly followed.

Why This Is a Classic Supply Chain Risk

The Kaseya incident is rightly classified as a supply chain attack because the attackers deliberately chose a link high up in the chain. By compromising one supplier, they gained access to hundreds of organizations simultaneously. We know this principle from the physical supply chain: if you hit a central distribution center, you shut down multiple stores.

Digitally, it works the same way. What makes it extra complex is that many organizations do not have a complete overview of their digital chain. Contracts often focus on price and availability, less on security and crisis response. Executives implicitly assume that reputable suppliers have their affairs in order. The Kaseya incident shows that reputation is no guarantee. Supply chain risks therefore require executive attention, comparable to financial or legal risks, and not solely technical solutions.

Executive Lessons for Management and CISOs

An important lesson is that supply chain risks must be explicitly addressed at the executive level. This does not mean that executives need to become technical experts, but rather that they ask the right questions. Which suppliers have deep access to our systems? What happens if they fail or are compromised? And how quickly can we continue independently?

For CISOs, the challenge is to translate risks into understandable business impact. Terms like “remote management tooling” or “zero-day vulnerability” must be explained in terms of revenue loss, downtime, and reputation. Furthermore, this requires scenario thinking: not if, but when a supply chain partner is affected. The Kaseya incident demonstrates that a crisis plan without a supplier perspective is incomplete.

From Incident to Structural Improvement

On the positive side, the Kaseya incident has led to increased awareness in many organizations. Suppliers are increasingly being evaluated on their security measures, exit scenarios are being discussed, and backups are being disconnected from management platforms. We also see that Dutch organizations are scrutinizing MSP arrangements more critically and contractually defining how incidents are reported and handled. These are steps in the right direction.

Supply Chain Risk Management is not a one-time project but an ongoing process that evolves with digitalization. The Kaseya story demonstrates that transparency, collaboration, and executive involvement are essential. Those who take these lessons seriously not only enhance their digital resilience but also the trust of customers and partners in an increasingly complex chain.