[APAC Region] SaaS Defense Quarantining Emails and Files From SharePoint

We have completed restoration of all files and emails that were falsely quarantined during the incident. All recoverable data has been returned to its original location across OneDrive, SharePoint, and Exchange.

A small subset of files quarantined between July 4th, 15:00 UTC and July 7th, 06:15 UTC may not be restorable due to missing metadata required for the “release from quarantine” process.

While we have visibility into which files were quarantined during this window, they cannot be restored via the SaaS Defense console. Affected users may need to retrieve these items from their recycle bin or cloud backup.

The underlying issue causing false quarantines has been fully resolved, and rescans are no longer resulting in false positives.

If further assistance is needed, please contact Kaseya Support. This incident has been resolved.

We’ve completed a system-wide cleanup to prevent further false positive rescans. In the rare case a rescan still triggers a false quarantine, we are applying corrective actions to prevent recurrence.

Restoration of affected files is underway. This is an ongoing process, and once a file is restored, it will not be quarantined again. Some files may not be restored automatically due to cache-related issues. Users can manually restore any missed files via OneDrive, SharePoint, or email recycle folders without impacting our efforts.

We are continuing restoration attempts but do not have an ETA for full completion. Thank you for your patience.

The unquarantine process is underway for impacted files and emails. It is expected to take a few hours to complete.

Details:
OneDrive / SharePoint: Files are being restored to their original locations, with duplicates retained in the quarantined folder (Recycle Bin).

Email: Emails and attachments are being restored to the inbox. No copy remains in the Junk folder.

Cache Cleanup is complete. This will ensure that previously affected files will not be incorrectly re-quarantined during rescans.

What’s Happening Now:
Cache Cleanup Underway: We are in the process of clearing cached verdicts for impacted files. This will stop previously affected files from being incorrectly re-quarantined during rescans.

What’s Next:
We will be initiating the unquarantine process for affected files in the next phase. A follow-up update will be provided when this step is underway.

The current fix prevents new false positive verdicts.

We are still investigating an issue with re scans still triggering malicious verdicts on items that were scanned during the July 4–7 outage window.

The current impact of this issue for customers in monitored mode is that affected files are not being quarantined, but still flagged as malicious. For others, the impact is that these files are being re-quarantined based on the re scan results.

The Kaseya R&D team is currently working to stop the re scans from returning incorrect verdicts.

A fix has been implemented and we are monitoring the results.

Service has been restored to it original state, records pertaining to false positive file quarantines are being removed from our system.

Users may continue to experience intermittent false positives throughout the morning as the record removal is being completed.

We will continue monitoring the platform for additional false positives and will take action as necessary.

The issue has been identified and a fix is being implemented.

We are continuing to investigate this issue.

The original problem has resurfaced and R&D is engaged and investigating a resolution

Engineering is working on a residual issue that may cause SharePoint/OneDrive files to get erroneously quarantined.

Engineering team has identified the issue and made the necessary changes to SaaS Defense Detection Mechanism to stabilize the process and reduce the abnormal amount of false positives. We are monitoring the situation now.

We are continuing to investigate this issue.

We are aware of a problem where SaaS Defense customers may experience problems with a high volume of legitimate emails and SharePoint files being quarantined.

Please rest assured that our team is treating this with urgency and doing everything possible to resolve this issue as quickly as possible.

Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/