No impact incident

Kaseya: Datto AV - Increase in PDF detection as PHISH/PDF

Affected: Datto AV

Current status of Kaseya: Under maintenance — live Kaseya status

Timeline

1. Oct 28, 2026, 18:50 UTC
   investigating
   We are aware of a problem where Datto AV is incorrectly flagging newly created .pdf files as PHISH/PDF, causing the files to be quarantined. The Kaseya R&D Team is currently investigating this issue. In the meantime our Support team has been supplied with a workaround and can assist you with implementing it. If you would like to have the workaround applied, please create a ticket with our Support team or contact them at 833-863-2237. To work around this issue: Adding exclusions for the affected folders and files. Then restoring the affected files. Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/
2. Oct 29, 2026, 15:13 UTC
   monitoring
   Our engineering team has identified the issue and is monitoring the fix. Some PDF files, were incorrectly flagged as PHISH/PDF.Agent. A specific detection rule has been disabled in VDF 8.21.8.130, deployed October 28, 2026. The rest of the PHISH detection category remains active. We are monitoring to confirm new false positives have stopped. Files that have already been quarantined must be restored manually.
3. Nov 3, 2026, 17:47 UTC
   resolved
   This incident has been resolved.

Updates as published by Kaseya (original).