WASHINGTON—The software company linked to a massive ransomware spree that began last week and has impacted hundreds of organizations across the globe was notified in early April of a cybersecurity vulnerability used in the attack, according to the Dutch security researcher group that discovered the issue.
Kaseya Ltd., a Miami-based software supplier that helps technology-service providers manage computer networks, was told of a serious cybersecurity hole in its Kaseya VSA software on April 6, Victor Gevers, chairman of the Dutch Institute for Vulnerability Disclosure, said Wednesday. Mr. Gevers’s organization, which is a volunteer-run security group, discovered the flaw.
“When we discovered the vulnerabilities in early April, it was evident to us that we could not let these vulnerabilities fall into the wrong hands,” Mr. Gevers said in a blog post. “After some deliberation, we decided that informing the vendor and awaiting the delivery of a patch was the right thing to do.”
Kaseya declined to comment on the timeline but said that Mr. Gevers’s organization “has been a great partner and we value the service they provide.”
The flaw reported by the Dutch group was one of seven vulnerabilities the group reported to Kaseya concerning its software, Mr. Gevers said. Kaseya has said multiple flaws were chained together in the attack, but it wasn’t clear exactly how the attack was carried out or the extent to which all the flaws were used.
