At least three Australian MSPs, 300 customer sites hit in Kaseya ransomware attack

At least three Australian MSPs and their customers have been affected by the recent ransomware attack affecting Kaseya on-premise software.

Kaseya confirmed that three Australian MSPs were affected in the attack which hit a number of the software company's on-premise customers.

A spokesperson from the company told CRN that not all customers using the on-premise version of Kaseya's software were affected and that under 60 customers in total were impacted.

CRN has confirmed that one MSP had at least 300 customer sites hit with ransomware.

One south-western Sydney-based MSP who spoke to CRN on the condition of anonymity said they had received requests from two other MSPs requesting technical assistance in dealing with the fallout.

Further, the MSP reported that while Kaseya contacted one of these MSPs directly by phone at around 2 am AEST, the other was only notified by email almost four hours later.

The Kaseya representative said in an email to CRN that the company emailed, phoned and posted notices to contact affected partners "any way we were able".

Kaseya said earlier that the cyberattack impacted only a small percentage of its more than 36,000 customers, with none of Kaseya’s SaaS customers ever at risk.

Ransomware operator REvil, which is behind the attack, has made the largest ransom demand of all time, demanding US$70 million (~AU$93.5 million at time of publication) to decrypt the 1,000-plus victims in the Kaseya ransomware attack.

A universal decryptor would provide victims with an easier and faster path to recovery, and REvil is likely hoping that insurers see US$70 million as a small price to pay for eliminating some downtime, Emsisoft threat analyst Brett Callow told CRN US.

The company also hired cybersecurity company FireEye Inc to help deal with the fallout of a major breach that has affected hundreds of businesses worldwide.

An earlier version of this story stated that up to five MSPs had been impacted in Australia. This was based on information provided by Kaseya which has since informed CRN that only three of its local MSP partners were affected.