iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Progressive Computing recovered from the July 2021 Kaseya ransomware attack by coordinating a volunteer surge across fellow managed-service providers (MSPs), then restoring client systems one environment at a time. Robert Cioffi, the Yonkers, New York, MSP’s co-founder, described the opening minutes as “suffocating and drowning” and said, “I was staring into the abyss.” The recovery shows why an MSP incident is simultaneously a technical emergency, a customer-operations crisis and a test of the wider professional community.
What happened to Progressive Computing
Kaseya’s compromised remote-monitoring-and-management (RMM) ecosystem allowed ransomware to spread across the environments Progressive Computing managed. All 80 of the MSP’s client environments were encrypted. Cioffi watched the attack reach his own computer as its icons turned white, making the threat immediate rather than theoretical.
The scale was unusual even for a serious ransomware event: Progressive Computing was responsible for about 2,500 endpoints and 250 servers. A compromise at the MSP therefore became a simultaneous recovery project for dozens of separate businesses, each with different applications, data, priorities and tolerance for downtime.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Reagan Roney of Solvere One IT captured the expectation gap MSPs face: “We’re supposed to have it all—so that we’re 100 percent secure, that we 100 percent know what we’re doing. But the reality is, we don’t. We know a lot. We’re doing everything we can, but we can’t control everything. But our clients expect it.”
#1 Best Overall
The documented recovery result
CRN’s 2023 account of Cioffi’s experience records the following scope and outcome:
| Measure | Documented figure | Qualification |
|---|---|---|
| Client environments encrypted | 80 | Every Progressive Computing client environment was affected. |
| Endpoints under management | 2,500 | Systems for which Progressive Computing was responsible. |
| Servers recovered | 250 | All 250 servers were recovered. |
| Endpoints recovered | 95% | Reported by Cioffi as restored within 17 calendar days. |
| Outside organizations contributing help | 27 | Organizations that provided free assistance. |
| Volunteer helpers | More than 50 | Free technical and operational support, according to the CRN account. |
| Top-line revenue impact | 15% loss | A temporary decline that Cioffi said was later regained. |
The figures describe restoration, not a claim that every business consequence ended at the same time. They do show that the MSP returned the overwhelming majority of its managed estate to service on a compressed timetable while coordinating work across many customers.
How the MSP community changed the recovery equation
Progressive Computing did not try to solve the incident with its normal staffing level. Twenty-seven organizations supplied more than 50 people at no charge, creating surge capacity for triage, rebuilding, validation and customer support. The practical value was not only extra hands; it was the ability to run many customer workstreams in parallel while the core team handled decisions and communications.
Cioffi described the approach as a collective effort: “We were, together as a team, going to undo this mess.” He also acknowledged the uncertainty at the outset: “Quite frankly, I really didn’t understand how. But I knew that together, we were going to get it done.”
That model addresses a structural weakness in MSP response. An internal team may understand its tools and customers, but a multi-client ransomware event can consume available engineers before restoration has even been prioritized. Trusted peers can provide specialist knowledge, independent judgment and staffing without waiting for a commercial incident-response engagement to be negotiated.
What an MSP incident-response plan must account for
1. Contain the management plane first
An RMM compromise can turn one access path into a fleet-wide event. The response plan should define who can isolate management infrastructure, suspend automation, disable affected accounts and preserve evidence. Those actions need an approved order of operations so that containment does not accidentally destroy information needed for recovery or insurance.
2. Build a customer-by-customer impact map
A generic severity label is not enough when every client has a different business dependency. For each customer, record affected endpoints and servers, critical applications, identity systems, recovery priorities, legal or regulatory exposure, business owners and the next communication time. Tanaz Choudhury of TanChes Global Management warned that a plan must be tested against consequences: “It’s really important that you have a response plan, but you have to know the impact of that response plan that you are invoking. Because without that, you’re just throwing it at the wall and seeing what sticks.”
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →3. Verify backups independently of the compromised environment
Restoration decisions should distinguish clean, offline or otherwise independent recovery copies from backups that share the same management plane or credentials as production. The plan should specify how copies are tested, who can authorize their use and how restored systems are checked before reconnecting them. The published Progressive Computing account does not identify the backup products or architecture used, so MSPs should not infer a particular technology from the recovery result.
4. Create a surge-capacity roster before an incident
Maintain a list of vetted peer MSPs, specialist responders and former staff who can be called in under predefined terms. Assign a coordinator, access procedure, confidentiality terms and work queues. The Progressive Computing experience shows why this roster matters: outside capacity can be organized while the affected MSP is still overwhelmed.
5. Coordinate communications, insurance and technical work
Customers need a reliable cadence even when the technical picture is changing. Set an incident lead, a customer-communications lead and a documented approval path for status updates. Notify cyber-insurance and legal contacts according to policy requirements, and record restoration decisions and expenses as the event unfolds. Technical recovery without synchronized customer and insurer communications can create avoidable delays and conflicting instructions.
6. Rehearse restoration, not just detection
Tabletop exercises should run through the full chain: RMM isolation, inventory, customer prioritization, backup validation, rebuild, credential rotation, testing and return to service. Include a scenario in which the MSP’s own tools and workstation are encrypted, because Cioffi’s experience demonstrates how quickly the responder can become a victim.
A practical peer-assisted recovery playbook
- Declare the incident and freeze risky automation. Name a decision owner, preserve logs and stop actions that could propagate the compromise.
- Separate management access from recovery access. Use clean administrative paths and document every account, credential and connection being used.
- Inventory every client environment. Mark affected endpoints, servers, business-critical services and customer contacts.
- Prioritize by business impact. Restore the systems that unlock essential operations, safety functions or regulatory obligations first, rather than working in an arbitrary technical order.
- Activate the peer roster. Break work into bounded queues with an owner, acceptance criteria and handoff notes so volunteers can contribute safely.
- Restore and validate in waves. Test identity, applications, data integrity, monitoring and security controls before returning each environment to normal operations.
- Keep customers informed on a fixed schedule. Explain what is known, what is being tested, the next decision point and any customer action required.
- Close with lessons and evidence. Reconcile systems and expenses, preserve the incident record, review contractual and insurance obligations, and update the playbook based on observed gaps.
From one recovery effort to an MSP peer network
Cioffi argued that the industry needs a standing volunteer coaching and technical-response network for MSP cyber incidents, rather than relying on improvised contacts after an attack. His broader conclusion was direct: “It’s the only way that I think we can really fight cybercriminals. If we link arms together, there’s a way for us to defeat [our] enemies.”
Kaseya’s current community page reports participation from more than 100,000 MSPs and IT teams, over 150,000 discussions, more than 25,000 questions answered and members in 32 countries. Those are community-reported figures, not a guarantee that a responder is available for a particular emergency. Paul Philips, CEO and founder of Xeperno, summarized the value of such a network: “No single organization has all the answers, but together, our community does.”
For an MSP evaluating peer support, the useful questions are practical: Who has already been vetted? Can they provide technicians during a multi-client outage? How are access and confidentiality handled? Who coordinates customer communications? And can the arrangement work alongside legal counsel, cyber-insurance requirements and independent incident responders?
Why this case still matters
Progressive Computing’s experience demonstrates that an RMM compromise is not merely a software-security incident. It can cascade into dozens of customer environments, exhaust an MSP’s normal capacity and force technical, operational and communications decisions at once. The recovery outcome was enabled by disciplined coordination and a large peer contribution, while the account’s clearest planning lesson is to measure the business impact of each customer before choosing a response action.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
