[https://amp.cnn.com/cnn/2021/12/16/tech/kronos-ransomware-attack/index.html (https://amp.cnn.com/cnn/2021/12/16/tech/kronos-ransomware-attack/index.html)]
You may not know Kronos/UKG by name but chances are you or someone you know works for an employer who uses their payroll software or cloud computing services. This hack has the potential to impact millions. And that's just accounting for delayed payroll. What isn't yet known is whether people's personal data has been compromised. As you can imagine payroll information is some of the most sensitive data that one definitely would not want to fall into the wrong hands - names, dob, ssn, bank account info for payroll deposit, potentially even 401(k) and other retirement accounts tied to payroll deductions.
Worse still: the suspected vulnerability at issue (Log4j) is really pernicious so this may just be the first of more major breaches to come to light in the coming weeks.
Remember when we were all eagerly awaiting the end of 2020 because 2021 was going to be a much better year?
Yeah I also fondly recall when I believed in Santa and the tooth fairy.
Thanks for posting this.
Kronos being compromised is a huge deal for those companies using their payroll services. Payroll is an extremely labor intensive and unforgiving process when a failure occurs. On top of that it appears as though key data for many employees has been compromised.
The data such as name, address, SS wages and tax withholding for 2021 is extremely valuable to a bad player. Those with compromised data have a very probability of having fraudulent tax returns filed with this data and having the IRS pay refunds since the data is likely to agree with previous quarterly data field for the employee.
Meanwhile cutting paper check sounds simple but picture the labor needed to cut and mail 5,000 payroll checks weekly and the delay for the employees and the high probability of wrong hours for hourly employees. Then the clean up of the overpayment/underpayment errors will have to be done. In short an expensive payroll mess.
https://clecityhall.com/2021/12/13/city-of-cleveland-statement-on-ultimate-kronos-group-cybersecurity-incident/
https://www.theverge.com/2021/12/15/22838737/kronos-ukg-ransomware-attack-payroll-tesla-whole-foods-cybercrime
https://enews.wvu.edu/articles/2021/12/15/wvu-faculty-and-staff-not-affected-by-recent-ukg-cyberattack
https://www.nbcnews.com/tech/security/ransomware-attack-threatens-paychecks-just-christmas-rcna8795
https://www.wvsao.gov/ (under press releases)
Quote from: wolf_from_wv on December 17, 2021, 12:41:05 PM
https://clecityhall.com/2021/12/13/city-of-cleveland-statement-on-ultimate-kronos-group-cybersecurity-incident/
https://www.theverge.com/2021/12/15/22838737/kronos-ukg-ransomware-attack-payroll-tesla-whole-foods-cybercrime
https://enews.wvu.edu/articles/2021/12/15/wvu-faculty-and-staff-not-affected-by-recent-ukg-cyberattack
https://www.nbcnews.com/tech/security/ransomware-attack-threatens-paychecks-just-christmas-rcna8795
https://www.wvsao.gov/ (under press releases)
Great links and great insights.
The Reddit post referenced is what most will have to do. This particular time of the year is a critical payroll period since there is generally only 1 or 2 paychecks left in the year to correct any errors before the year end payroll close. That close date is a hard and fast date of 12/31.
This may sound easy but 800 new vendors will have to be checked and 800 manual amounts will have to be entered and worst of all everything will need to be reconciled before w-2 can be printed. There are a bunch of accountants who will not have a Merry Christmas or a New Year's Day off.
QuoteOur Strategy:
We will be processing our payroll through our Accounts Payable Department.
We are importing all of our employees (currently 800 due to the pandemic - actually a good thing at this point) into Dynamics GP as vendors.
We will use the last 3 pay cycle reports to calculate the average of the employees net pay and will process the average as an invoice in Dynamics.
Payroll checks will then be run for the corresponding invoices. Taxes, FICA, 401K etc will all be trued up following UKGs ability to get back online. This will be a nightmare at best, but it is the only option we have at present since WFC calculates all of this automatically and we currently have no way to do so.
We are also aware that some employees will be paid less than they should be, and some will be paid more. This will also be rectified through payroll later.
In the meantime employees are still punching at clocks, and also filling out a time-in/time-out paper log which will be cross referenced following recovery. Any missed punches will have to be manually entered into Kronos once live.
Edited to add December and January is the time of year my companies systems are always probed and hacks are attempted. The hackers are always trying to get to our HR/Payroll files for employee data.
My company uses UKG for payroll , also for our benefits enrollment, and company stuff like vacations death beneficiary's. Last time we got hacked was a few years ago , the company did payroll in house and got hacked, the ransom was 60K in bit coin. They thought this was a safer and more cost effective thing to do. They got everyone basic life lock for 1 year after that, but with all the hoops to jump through most were unable to get through it in time.
Me and my folks are affected by this. :( I got to recreate ~5 weeks of timecards.. :(