Kaseya denied paying a ransom to obtain a key to decrypt its systems following a ransomware attack that affected businesses across the globe.
The Miami software and IT firm obtained the decryptor tool on July 21 from an unnamed third party, according to a statement posted to its website. Kaseya was breached ahead of the July 4 weekend by REvil, a Russia-linked cybercriminal group that demanded a $70 million ransom in cryptocurrency to restore affected customers’ data.
"Recent reports have suggested that our continued silence on whether Kaseya paid the ransom may encourage additional ransomware attacks, but nothing could be further from our goal," the statement said. "Kaseya decided after consultation with experts to not negotiate with the criminals who perpetrated this attack and we have not wavered from that commitment."
Kaseya did not pay the ransom directly or through a third party, the statement said. The company is providing the decryption tool to customers who request it.
CEO Fred Voccola told the Business Journal the cyberattack ultimately compromised 56 of its Kaseya VSA customers. The VSA platform allows clients to remotely manage and monitor devices across an organization.
However, because some of those customers provide IT services to other companies, hundreds of other businesses may have been indirectly affected by the hack as well.
Voccola declined to specify how exactly the cyberattack impacted Kaseya's direct customers. Reuters previously reported the attack hobbled hundreds of supermarkets in Sweden where cash registers were taken offline, and schools in New Zealand that used Kaseya networks.
"Any customer that gets breached is one too many, but this affected fewer than 60 of our 36,000 customers. So we protected more than 35,000 by acting quickly," Voccola said.
Kaseya immediately shut down its VSA system and consulted with a host of IT experts – including the FBI and the federal Cybersecurity and Infrastructure Security Agency (CISA) – when it became aware of the hack July 2. The software firm reports it released a patch to fix the vulnerabilities targeted by the hackers and restored service to customers within days.
"I hate the fact that the company I love was on the front pages of the newspapers for this, but it happened. The best approach was to confront the problem, be transparent and communicate as much as we can," Voccola said.
Cyberattacks like the one waged on Kaseya are a growing concern for small and large businesses alike in a digital-first world. According to the University of Maryland, 64% of businesses have experienced a web-based attack. Cybercrime cost businesses $3.5 billion in 2019 alone, the FBI reports.
Voccola is concerned that some cryptocurrencies will exacerbate the issue. The hackers behind the Kaseya attack, for example, demanded the multi-million ransom in Monero, a digital currency that bills itself as being untraceable.
"For law enforcement, one of the best tools they have is the ability to follow the money. But most ransomware attacks are derived in anonymous currencies," he said. "I'm not a policymaker; I'm a business person. I think people smarter than me need to get together and come up with solutions that address this problem."
Kaseya, founded in 2000, is one of South Florida's oldest technology firms. Voccola confirmed the company is moving forward with a plan to hire 500 employees over the next year, with half of those new hires based in Miami.
For more stories like this one, sign up for Miami Inno newsletters from the South Florida Business Journal and the American Inno network.
