Just in time for Christmas, Kronos payroll and HR cloud software goes offline due to ransomware

2 years ago 457

The onslaught has led to an outage expected to past weeks, leaving companies scrambling to marque payroll with the holidays close astir the corner.

Young Asian antheral frustrated by ransomware cyber attack

We're experiencing yet different incidental successful which cyberattacks tin impact the existent world: UKG, makers of payroll and HR software, person reported a ransomware onslaught that has taken its Kronos Private Cloud offline, and whitethorn effect successful it staying that mode for weeks to come.

The timing couldn't beryllium worse, nor could it beryllium much apt: We're a week distant from Christmas and the vacation question season, and conscionable days removed from the announcement of 1 of the worst zero-day bugs successful the past of ever: Log4Shell. It's chartless whether Log4Shell is liable for this incident, and UKG said determination aren't immoderate indications that it is.

SEE: Google Chrome: Security and UI tips you request to know (TechRepublic Premium)

"As soon arsenic the Log4j vulnerability was precocious publically reported, we initiated accelerated patching processes … While we presently person nary denotation that determination is, we are investigating whether oregon not determination is immoderate narration betwixt the information incidental described supra and the Log4j vulnerability," UKG said.

Causes aside, the extremity effect is that a batch of large companies (KPC is utilized by Tesla, the City of Cleveland government, and aggregate banks and fiscal institutions) can't process payroll, and that means radical mightiness spell into the holidays unpaid.

Kronos outage: What was affected

Kronos Private Cloud is UKG's hosting solution for its Workforce Central, TeleStaff, Healthcare Extensions and Banking Scheduling Solution software. The ransomware attack, which was detected connected December 11, has meant that KPC and its hosted solutions are unavailable to customers.

Make nary mistake: This isn't a tiny problem. In a connection astir the outage, UKG said that it has nary estimated clip of resolution, that its backups aren't disposable until they "determine the champion approach" to restoration. UKG frankincense "continues to powerfully urge our customers enactment with their enactment to activate their concern continuity plans."

That's the tech equivalent of "fix bayonets," and it's atrocious quality not lone for Kronos customers but the aboriginal of UKG arsenic well, mostly due to the fact that determination is simply a quality betwixt an outage owed to uncontrollable factors, similar terrible weather, and a malware incident, said Forrester information and hazard expert Allie Mellen.

"Customers volition beryllium much apt to judge downtime from thing similar a terrible upwind lawsuit due to the fact that they tin much easy subordinate to a kinetic challenge. In contrast, customers whitethorn beryllium wary of trusting a concern deed with a cyberattack due to the fact that it's much unpredictable and little relatable and tangible," Mellen said.

Was immoderate information stolen?

The authoritative enactment from UKG is that its probe is ongoing, but the City of Cleveland told a section quality presumption that UKG told it that the onslaught "may person compromised immoderate employees' archetypal and past names, addresses, past 4 SSN digits and worker ID," Cleveland's WKYC reported.

Ransomware gangs person been known to extort victims by threatening to (or actually) releasing delicate data, and there's nary crushed to presume this onslaught is immoderate different. If, arsenic is presently believed, Log4Shell isn't involved, past there's nary telling however agelong Kronos Private Cloud could person been compromised.

"It's apt the attacker had been targeting Kronos for immoderate clip anterior to the detonation of the ransomware," Mellen said. Until we cognize erstwhile and however the archetypal penetration occurred, it's harmless to presume Kronos Private Cloud customers whitethorn person had delicate information stolen and react accordingly.

How Kronos Private Cloud customers tin recover

UKG itself has admitted that it is successful uncharted waters, and it's telling customers to "evaluate and instrumentality alternate concern continuity protocols related to the affected UKG solutions."

As TechRepublic genitor institution TechnologyAdvice's Tamara Scott writes, businesses volition need, astatine a minimum, "a quality resources accusation strategy to stitchery addresses, banking and interaction information; a clip tracking and scheduling bundle to recreate schedules; and a payroll strategy to get their employees paid."

SEE: Password breach: Why popular civilization and passwords don't premix (free PDF) (TechRepublic)

Thankfully, HR bundle is arsenic plentiful and varied arsenic the companies that request it. Don't hold oregon edifice to doing things connected insubstantial — the quickest mode backmost to concern is going to beryllium moving on, and quickly. You tin measure what you privation to bash afterward erstwhile things person calmed down.

UKG has besides been bully astir updating its outage presumption page with regular news, truthful beryllium definite you enactment tuned for the latest updates.

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays