Ransomware Attack on Major Payroll System Kronos May Take 'Weeks' to Repair

Earlier this week long-time Slashdot reader DJAdapt wrote:
According to a post on the Kronos Community Page, a cyber security incident due to a ransomware attack is affecting UKG Workforce Central, UKGTeleStaff, Healthcare Extensions, and Banking Scheduling. Although they are currently working with cyber security experts on the issue, they say that it may take several weeks to restore full system availability.

CNN reported:
Ultimate Kronos Group, one of the largest human resources companies, disclosed a crippling ransomware attack on Monday [December 13th], impacting payroll systems for a number of workers. After noticing 'unusual activity' on Saturday [December 11th], Kronos noted that its systems were down and could remain that way for several weeks.

Kronos has a long list of notable customers across the public and private sector, including the city of Cleveland, New York's Metropolitan Transportation Authority (MTA), Tesla and MGM Resorts International. It also works with many hospitals across the country. Some employers find themselves having to make contingency plans in order to pay workers, such as shifting to paper checks. And some impacted employees have been unable to access payroll systems...

In addition to the potential payroll issues, there's also data privacy concerns. The city of Cleveland said in a statement Monday that Kronos alerted it that sensitive information may have been compromised in the attack. Employee names, addresses and the last four digits of social security numbers may have been stolen by the hackers inside Kronos's network.
Other Kronos customers include Whole Foods, GameStop and Honda, as well as state and local government agencies like the state of West Virginia, reports NBC News:
John Riggi, the senior advisor for cybersecurity at the American Hospital Association, an industry group, said that he had spoken with multiple hospitals that have had to create contingency plans for getting employees paid, managing their schedules and tracking their hours. 'Quite frankly, this could not have happened at a worse time. We've had a surge in Covid patients, flu patients,' Riggi said. 'It's a distraction to hospital administrators at a time when they don't need any additional burden or diversion of resources.'


'Though it has not been confirmed, there is speculation that the notorious Log4Shell vulnerability was involved,' writes CPO magazine, 'given that the Kronos cloud services are known to be built on Java to a great degree....'

'Microsoft's security team has reported that ransomware attacks are already unfolding after these breaches in at least several cases.'

Read more of this story at Slashdot.