Outage in Datto

[APAC Region] SaaS Defense Quarantining Emails and Files From SharePoint

Resolved Major
July 07, 2025 - Started 24 days ago - Lasted 15 days
Official incident page

Need to monitor Datto outages?
Stay on top of outages with IsDown. Monitor the official status pages of all your vendors, SaaS, and tools, including Datto, and never miss an outage again.
Start Free Trial

Outage Details

We are aware of a problem where SaaS Defense customers may experience problems with a high volume of legitimate emails and SharePoint files being quarantined. Please rest assured that our team is treating this with urgency and doing everything possible to resolve this issue as quickly as possible. Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/
Latest Updates ( sorted recent to last )
RESOLVED 9 days ago - at 07/21/2025 08:28PM

We have completed restoration of all files and emails that were falsely quarantined during the incident. All recoverable data has been returned to its original location across OneDrive, SharePoint, and Exchange.

A small subset of files quarantined between July 4th, 15:00 UTC and July 7th, 06:15 UTC may not be restorable due to missing metadata required for the “release from quarantine” process.

While we have visibility into which files were quarantined during this window, they cannot be restored via the SaaS Defense console. Affected users may need to retrieve these items from their recycle bin or cloud backup.

The underlying issue causing false quarantines has been fully resolved, and rescans are no longer resulting in false positives.

If further assistance is needed, please contact Kaseya Support. This incident has been resolved.

MONITORING 12 days ago - at 07/18/2025 04:06PM

We’ve completed a system-wide cleanup to prevent further false positive rescans. In the rare case a rescan still triggers a false quarantine, we are applying corrective actions to prevent recurrence.

Restoration of affected files is underway. This is an ongoing process, and once a file is restored, it will not be quarantined again. Some files may not be restored automatically due to cache-related issues. Users can manually restore any missed files via OneDrive, SharePoint, or email recycle folders without impacting our efforts.

We are continuing restoration attempts but do not have an ETA for full completion. Thank you for your patience.

MONITORING 13 days ago - at 07/17/2025 09:54PM

The unquarantine process is underway for impacted files and emails. It is expected to take a few hours to complete.

Details:
OneDrive / SharePoint: Files are being restored to their original locations, with duplicates retained in the quarantined folder (Recycle Bin).

Email: Emails and attachments are being restored to the inbox. No copy remains in the Junk folder.

MONITORING 13 days ago - at 07/17/2025 05:43PM

Cache Cleanup is complete. This will ensure that previously affected files will not be incorrectly re-quarantined during rescans.

MONITORING 13 days ago - at 07/17/2025 03:52PM

What’s Happening Now:
Cache Cleanup Underway: We are in the process of clearing cached verdicts for impacted files. This will stop previously affected files from being incorrectly re-quarantined during rescans.

What’s Next:
We will be initiating the unquarantine process for affected files in the next phase. A follow-up update will be provided when this step is underway.

IDENTIFIED 13 days ago - at 07/17/2025 03:32PM

The current fix prevents new false positive verdicts.

We are still investigating an issue with re scans still triggering malicious verdicts on items that were scanned during the July 4–7 outage window.

The current impact of this issue for customers in monitored mode is that affected files are not being quarantined, but still flagged as malicious. For others, the impact is that these files are being re-quarantined based on the re scan results.

The Kaseya R&D team is currently working to stop the re scans from returning incorrect verdicts.

MONITORING 19 days ago - at 07/11/2025 12:52PM

A fix has been implemented and we are monitoring the results.

IDENTIFIED 20 days ago - at 07/11/2025 01:54AM

Service has been restored to it original state, records pertaining to false positive file quarantines are being removed from our system.

Users may continue to experience intermittent false positives throughout the morning as the record removal is being completed.

We will continue monitoring the platform for additional false positives and will take action as necessary.

IDENTIFIED 20 days ago - at 07/10/2025 07:06PM

The issue has been identified and a fix is being implemented.

INVESTIGATING 21 days ago - at 07/09/2025 07:39PM

We are continuing to investigate this issue.

INVESTIGATING 22 days ago - at 07/09/2025 01:19AM

The original problem has resurfaced and R&D is engaged and investigating a resolution

IDENTIFIED 22 days ago - at 07/08/2025 10:25AM

Engineering is working on a residual issue that may cause SharePoint/OneDrive files to get erroneously quarantined.

MONITORING 23 days ago - at 07/07/2025 07:39AM

Engineering team has identified the issue and made the necessary changes to SaaS Defense Detection Mechanism to stabilize the process and reduce the abnormal amount of false positives. We are monitoring the situation now.

INVESTIGATING 24 days ago - at 07/07/2025 04:07AM

We are continuing to investigate this issue.

INVESTIGATING 24 days ago - at 07/07/2025 03:24AM

We are aware of a problem where SaaS Defense customers may experience problems with a high volume of legitimate emails and SharePoint files being quarantined.

Please rest assured that our team is treating this with urgency and doing everything possible to resolve this issue as quickly as possible.

Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/

Be the First to Know When Vendors Go Down

With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.

Start free trial

No credit card required · Cancel anytime · 4400 services available

Integrations with Slack Microsoft Teams Google Chat Datadog PagerDuty Zapier Discord Webhook