Current:Home > NewsKronos hack will likely affect how employers issue paychecks and track hours-LoTradeCoin
Kronos hack will likely affect how employers issue paychecks and track hours
View Date:2024-12-24 00:03:16
A ransomware attack on one of the largest human resources companies may impact how many employees get paid and track their paid time off.
Human resources management company Ultimate Kronos Group (known as Kronos) said it suffered a ransomware attack that may keep its systems offline for weeks.
To ensure employees are paid, companies that rely on the software are working to find backup plans — including issuing paper checks, some for the first time in years.
Kronos is used widely around the U.S. by businesses and governments to track employees' hours and to issue pay. Its many customers include municipal governments, university systems and large corporations. (NPR also uses Kronos.)
According to a spokesperson for Kronos, the ransomware attack has affected only customers that use a particular product called the Kronos Private Cloud.
"We took immediate action to investigate and mitigate the issue, have alerted our affected customers and informed the authorities, and are working with leading cybersecurity experts. We recognize the seriousness of the issue and have mobilized all available resources to support our customers and are working diligently to restore the affected services," the spokesperson said in a statement to NPR.
What employers are affected?
Dozens of companies and governmental organizations announced this week that they have been affected by the attack — a number that falls far short of the attack's likely impact, given the ubiquity of Kronos.
The hack has affected scheduling products specifically designed for health care systems, financial institutions and public safety workers.
Over the course of Monday and Tuesday, many employers announced to their staffs that they had been affected — such as employees of New York's Metropolitan Transportation Authority, hospital workers in San Angelo, Texas, and public water workers in Honolulu.
The city of Cleveland, which employs thousands of workers, said in a statement Monday that it is among the employers that rely on the hacked software, as does the Oregon Department of Transportation.
And a number of universities, such as the University of Utah, George Washington University and Yeshiva University in New York, also reported being affected.
How does it affect paychecks?
The extent to which individual employees are affected depends on how their employers used the software.
Employers that used Kronos to clock employees in and out of shifts may ask workers to manually track start and end times, while companies that rely on Kronos to issue paychecks may send out paper checks so long as the service is down.
Employers may also choose to issue generic paychecks that compensate employees for a baseline number of scheduled hours, rather than the actual hours worked — and later issue corrections as needed.
The Fair Labor Standards Act requires employers to track hours worked by employees no matter the timekeeping method used (in other words, via Kronos, a manual timecard or otherwise), then pay their workers promptly. Individual states may further govern exactly how often those paychecks must come.
What about personal data?
As for personal data, what employee information is stored in Kronos — and therefore could be exposed to attackers — varies by employer.
In statements to employees, several companies said that they believed the most sensitive personal data, including Social Security numbers, had not been breached — but the city of Cleveland warned employees that the last four digits of Social Security numbers could be at risk.
Dan Meyer, managing partner for Tully Rinckey PLLC, an Albany, N.Y.-based law firm, says the safest thing an employee can do in terms of personal data is to start changing your passwords.
"By doing this, you'll protect yourself quite well from whatever may have dribbled out from these systems," Meyer said in an interview with NPR.
How long before the service is fixed?
The service could be out for "several weeks," according to a blog post by Bob Hughes, Kronos' chief customer and strategy officer. The post was published Sunday, though it was later inaccessible.
Because the fix could take long enough to affect payroll and scheduling operations, the company has urged employers to seek out "alternative business continuity protocols" while it works on a fix.
Is this related to Log4j?
As of Tuesday, it was not clear how the ransomware attackers were able to knock the software offline.
The incident comes on the heels of revelations about a major vulnerability in a piece of software called Log4j that is frequently used with the programming language Java.
The Log4j flaw allows a remote hacker to take over a device or system running the software, permitting the hacker to, among other things, install crypto-miners or steal private data.
Because Java is among the most widely used programming languages in the world, cybersecurity researchers have warned that the effects could be widespread.
It is not yet a given that the Kronos hack is related to the Log4j vulnerability, said Allan Liska, an intelligence analyst at the cybersecurity firm Recorded Future.
"It is likely the attacker had been in Kronos for weeks launching the attack before Log4J was reported. That doesn't mean the two aren't connected. But the best evidence right now says otherwise," he told NPR.
Additional reporting by Jenna McLaughlin.
veryGood! (5848)
Related
- Pete Rose fans say final goodbye at 14-hour visitation in Cincinnati
- House votes to hold Attorney General Merrick Garland in contempt for withholding Biden audio
- 2 girls, ages 7 and 11, killed after ATV crashes in Wisconsin
- Travis Kelce & Jason Kelce's Surprising Choice for Favorite Disney Channel Original Movie Is Top Tier
- Rita Ora pays tribute to Liam Payne at MTV Europe Music Awards: 'He brought so much joy'
- A 9-year-old child is fatally shot in Milwaukee, the city’s 4th young gunshot victim in recent weeks
- Questlove digs into the roots of hip-hop and its impact on culture in new book
- Planned Parenthood Oregon leaders plan to dissolve political arm, sparking concerns about advocacy
- Whoopi Goldberg Shares Very Relatable Reason She's Remained on The View
- Historically Black Coconut Grove nurtured young athletes. Now that legacy is under threat
Ranking
- Kristin Cavallari's Ex Mark Estes Jokingly Proposed to This Love Island USA Star
- Texas dad, son find message in a bottle on the beach, track down intended recipient
- Newtown High graduates told to honor 20 classmates killed as first-graders ‘today and every day’
- Federal judge who presided over R. Kelly trial dead at 87 after battling lung cancer
- Chris Pratt and Katherine Schwarzenegger welcome their first son together
- Rob Schneider criticizes Will Smith for slapping Chris Rock at 2022 Academy Awards
- Senate Democrats to bring up Supreme Court ethics bill amid new revelations
- A skier disappeared nearly a month ago at Mt. Rainier. Park rangers make tragic discovery.
Recommendation
-
Sister Wives’ Meri Brown Shares Hysterical Farmers Only Dating Profile Video After Kody Split
-
2024 US Open weather: Thursday conditions for first round at Pinehurst
-
Gunman hijacks bus in Atlanta with 17 people on board; 1 person killed
-
Pinehurst stands apart as a US Open test because of the greens
-
Prosecutors say some erroneous evidence was given jurors at ex-Sen. Bob Menendez’s bribery trial
-
Video shows National Guard officers enter home minutes before 4 women and 2 children were killed in Mexico
-
Anthony Michael Hall is loving 'Ms. Rachel,' cites this John Hughes movie as his favorite
-
Tom Brady's No. 12 'is now officially retired' by New England Patriots