UPDATE: "Kaseya's focus is on the customers who have been affected, and we are working tirelessly to get to the bottom of this issue. At this time we are not commenting on any speculation," Dana Liedholm, SVP of Corporate Marketing at Kaseya, told us in response to the allegations of the former employees.
"Kaseya's focus is on the customers who have been affected, and we are working tirelessly to get to the bottom of this issue. At this time we are not commenting on any speculation."
Former Kaseya staff have alleged that the company failed to address critical security flaws in its software several times between 2017 and 2020.
Earlier this month, threat actors exploited a zero-day vulnerability in Kaseya's VSA software to breach several managed service providers (MSP) and deliver ransomware to their downstream customers, numbering in the thousands.
Talking to Bloomberg, the five former anonymous employees from Kaseya’s software engineering and development department, say the company has a history of failing to address security issues.
- These are the best endpoint protection tools
- Here's our choice of the best malware removal software on the market
- Check our list of the best firewall apps and services
One of the former employees even believes they were fired for highlighting “multiple violations of basic cybersecurity practices.”
Skeletons in the cupboard?
The employees allege that not only is Kaseya software laced with outdated code, it also uses weak encryption and passwords, as they accuse the company of directing its focus on sales.
One of the former employees reportedly sent a 40-page memo detailing security concerns, and was dismissed about two weeks later.
Another pointed out that Kaseya rarely patched its software and stored customer passwords in clear text on third-party platforms, while listing the company’s failure to adhere to common security practices.
Alarmingly, a couple of former employees allege that one of the software that was problematic and “riddled with [security] problems” was Kaseya VSA.
Kaseya didn’t immediately respond to TechRadar Pro’s email on the allegations of the former employees. However, a Kaseya spokesperson declined to address the accusations when contacted by Bloomberg, citing its policy of not commenting on matters that involve personnel or an ongoing criminal investigation.
- Protect your devices with these best antivirus software
