Datto AV – Behavioral Detection Update

Incident Report for Kaseya Inc

Postmortem

Summary

Between February 26, 2026 and April 3rd, 2026, a subset of Datto AV customers experienced unexpected file quarantines. In these cases, Datto AV incorrectly identified certain legitimate files as threats and quarantined them.

Root Cause

The issue was caused by a Datto AV update released on February 26, 2026. This update did not deploy the required application exclusion file to systems where Datto AV had originally been deployed through Datto RMM prior to June 2025.

As a result, impacted systems lacked the necessary exclusions and misidentified certain files as malicious, leading to unintended quarantines.

A corrective update was released on April 3rd, 2026, which deployed the missing exclusions and resolved the issue.

Incident Timeline

Identified: March 05, 2026
Resolved: March 20, 2026

Posted May 12, 2026 - 11:07 EDT

Resolved

A fix was deployed 4/2/26 after 11pm and will install to agents during the next set maintenance window.

Posted Apr 03, 2026 - 09:24 EDT

Update

A fix has been developed and this will be released tonight, after 12am(EST) and applied during your next set maintenance window.

Posted Apr 02, 2026 - 11:03 EDT

Identified

We are aware of a low-frequency issue where certain legitimate files may be unexpectedly quarantined by a behavioral detection component.
What’s happening
In rare cases, a behavioral detection module may briefly activate during endpoint startup before policy settings are fully applied. During this short window, files that would normally be allowed may be flagged and quarantined.

Customer impact
Low probability, but non-zero
Quarantined files may not generate alerts in the console
Files cannot currently be restored directly from the portal

What we’re doing
Implementing a fix to ensure this component does not activate during startup
Rolling out updates in a controlled manner
Actively monitoring to ensure the issue is fully resolved

What you should do
If you believe this has impacted your environment:
Contact Support
Our team can assist with restoring files from quarantine

!!! Important !!!
Do not remove AV licenses from affected devices, as this may result in permanent deletion of quarantined files.

Next update
We will share progress as rollout completes and the fix is fully deployed.

Posted Apr 01, 2026 - 12:53 EDT

This incident affected: Datto AV.