Cyberattack on Kronos payroll triggers backup plans

Backup plans set into motion

Kronos, founded in 1977, is an HR systems provider widely known for its payroll and time management systems. It merged with Ultimate Software in 2020, and the combined company was renamed UKG. 

Government agencies that rely on Kronos payroll systems have initiated backup plans to make sure people get paid before the holidays.

In a statement, the city of Springfield, Mass., stated that "contingency plans for recording employee schedules and hours will be implemented to mitigate the potential adverse effects this incident might cause, and to make sure that employees will continue to receive their regular scheduled pay."

The city of Cleveland released a statement saying, "the city will continue timely payroll processing and ensure employees receive their pay without interruption."

Kronos was attacked. We use it for timekeeping. Everyone wanted to have meetings and phone calls but pay day is Friday. We don't have time for it. I did union payrolls on a typewriter with a Circular E back in the 80's. I'm the only one not panicking. Time to go Old School!

— 5GenTexan! Republic of Texas! (@5gentexan) December 14, 2021

Potential disruptions to pay

But it might not be easy. Responding to the firm's blog post about the cyberattack, one anonymous customer on a Kronos user forum wrote about using manual timesheets. "But, since we can't log into Kronos at all, how are we to calculate net pay? We have over 2,000 employees to pay this Friday."

Another person on the Kronos user forum described the ransomware attack as "a big miss" for UKG. The customer added: "It would have been nice to hear about this directly from UKG instead of hearing from other sources. It would allow us, the customer, to be proactive in being able to answer internal leadership and internal IT questions regarding the ransomware. Internal leadership and I were getting outside vendor calls from other payroll companies asking if we needed them to run our payroll for us."

In a blog post Monday, by Bob Hughes, executive vice president at UKG, didn't provide a time frame for restoration.

"We deeply regret the impact this is having on you, and we are continuing to take all appropriate actions to remediate the situation," Hughes wrote. 

Ransomware attacks can be disruptive. An attack on the city of Atlanta in 2018 infected nearly 4,000 of the city's computers, encrypting files in each computer and displaying a ransom note.

Patrick Thibodeau covers HCM and ERP technologies for TechTarget. He's worked for more than two decades as an enterprise IT reporter.