Live: DFLers and Republicans are endorsing candidates for governor, U.S. Senate and other statewide races

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

A ransomware attack on one of the largest human resources companies may impact how many employees get paid and track their paid time off.

Human resources management company Ultimate Kronos Group (known as Kronos) said it suffered a ransomware attack that may keep its systems offline for weeks.

Companies that rely on the software are working to find backup plans to ensure their employees are paid — including issuing paper checks, some for the first time in years. 

Kronos is used widely around the country by businesses and governments to track employees' hours and to issue pay. Its many customers include municipal governments, university systems and large corporations. (NPR also uses Kronos.)

According to a spokesperson for UKG, the ransomware has only affected customers that used a particular product called the Kronos Private Cloud. 

"We took immediate action to investigate and mitigate the issue, have alerted our affected customers and informed the authorities, and are working with leading cybersecurity experts. We recognize the seriousness of the issue and have mobilized all available resources to support our customers and are working diligently to restore the affected services," the spokesperson said in a statement to NPR. 

Dozens of companies and governmental organizations announced this week that they had been affected by the attack — a number that falls far short of its likely impact, given the ubiquity of Kronos.

The hack included scheduling products specifically designed for health care systems, financial institutions and public safety workers. 

Over the course of Monday and Tuesday, many employers announced to their staffs that they had been affected — such as 

employees of New York's Metropolitan Transportation Authority

The city of Cleveland, which employs thousands of workers, said 

 that it was among the employers who rely on the hacked software, along with 

 and Yeshiva University in New York, also reported being affected. 

The extent to which individual employees are affected depends on how their employers used the software. 

Employers that use Kronos to clock employees in and out of shifts may ask workers to manually track start and end times, while companies that rely on Kronos to issue paychecks may send out paper checks so long as the service is down. 

Employers may also choose to issue generic paychecks that compensate employees for a baseline number of scheduled hours, rather than the actual hours worked — and later issue corrections as needed. 

The Fair Labor Standards Act requires employers 

to track hours worked by employees no matter the timekeeping method used

 (in other words, via Kronos or a manual time card or otherwise), then pay their workers promptly. Individual states may further govern exactly how often those paychecks must come. 

As for personal data, what employee information is stored in Kronos — and therefore could be exposed to attackers — varies by employer. 

In statements to employees, several companies said that they believed the most sensitive personal data, including Social Security numbers, had not been breached — but 

 that the last four digits of Social Security numbers could be at risk.  

The service could be out for "several weeks," according to a blog post by Bob Hughes, the company's chief customer and strategy officer. The post was published Sunday, though it was later inaccessible. 

Because the fix could take long enough to affect payroll and scheduling operations, the company has urged employers to seek out "alternative business continuity protocols" while they work on a fix. 

As of Tuesday, it was not clear how the ransomware attackers were able to knock the software offline. 

The incident comes on the heels of revelations about 

a major vulnerability in a piece of software called Log4j

 that is frequently used with the programming language Java. 

The Log4j flaw allows a remote hacker to take over a device or system running the software, allowing them to, among other things, install crypto miners or steal private data. 

Because Java is among the most widely used programming languages in the world, cybersecurity researchers have warned that the effects could be widespread. 

It is not yet a given that the Kronos hack is related to the Log4j vulnerability, said Allan Liska, an intelligence analyst at the cybersecurity firm Recorded Future.  


"It is likely the attacker had been in Kronos for weeks launching the attack before Log4J was reported. That doesn't mean the two aren't connected. But the best evidence right now says otherwise," he told NPR.


Business and Economic News

Crime, Law and Justice

Technology

Becky Sullivan

Author

Jonathan Franklin

The attack affects several of its systems, including how employees can track their paid time off and how they can get paid, according to the company.

Kronos hack will likely affect how employers issue paychecks and track hours

Go Deeper.

Like this?

News you can use in your inbox