Timekeeping biz Kronos hit by ransomware and warns customers to engage biz continuity plans
(2021/12/13)
- Reference: 1639408025
- News link: https://www.theregister.co.uk/2021/12/13/ultimate_kronos_group_ransomware_attack/
- Source link:
Kronos Private Cloud has been hit by a ransomware attack. The company, also known as Ultimate Kronos Group (UKG), provides timekeeping services to companies employing millions across worldwide.
Emails sent by Kronos to its corporate customers, seen by The Register , confirm the firm has pulled its private cloud services offline following a ransomware attack. It is advising customers to deploy "alternative business continuity protocols" – a move with potential implications for Britons' Christmas pay packets.
Kronos' messages to corporate customers were identical in wording to [1]this post on Kronos' customer support forums, signed by exec veep Bob Hughes. It said:
We are reaching out to inform you of a cyber security incident that has disrupted the Kronos Private Cloud.
As we previously communicated, late on Saturday, December 11, 2021, we became aware of unusual activity impacting UKG solutions using Kronos Private Cloud. We took immediate action to investigate and mitigate the issue, and have determined that this is a ransomware incident affecting the Kronos Private Cloud — the portion of our business where UKG Workforce Central, UKG TeleStaff, Healthcare Extensions, and Banking Scheduling Solutions are deployed.
Kronos' timekeeping products are used by companies in the UK [2]including supermarket chain Sainsburys, Boots the Chemist and Jaguar Land Rover, and large outfits in the US including [3]Clemson Uni in South Carolina , USA; Winthrop University Hospital in Long Island, New York; and US state and local government customers such as Santa Clara County.
"Issues companies will have is employees don't know their schedule (it's in Kronos) and then when they clock in and out, that clock won't go anywhere," a Register reader, who works for an affected firm, told us.
[4]
Kronos' timekeeping service interfaces with companies' payrolls. In effect, it tells the payroll department how much to pay each staff member. The firm also provides rostering and shift management services.
[5]
[6]
"At this time, we are not aware of an impact to UKG Pro, UKG Ready, UKG Dimensions, or any other UKG products or solutions, which are housed in separate environments and not in the Kronos Private Cloud," concluded its statement.
The message from Kronos said restoring full service would take "several weeks."
[7]
We have asked the company for comment and will update this article if it responds.
A Sainsbury’s spokesperson said: “We’re in close contact with Kronos while they investigate a systems issue. In the meantime we have contingencies in place to make sure our colleagues continue to receive their pay.”
It is not yet known whether the Log4j remote code execution vulnerability was the attackers' way in. Neither is the attackers' identity publicly known at the time of writing.
[8]Ransomwared payroll provider leaks data on 38,000 Australian government workers
[9]Irish Health Service ransomware attack happened after one staffer opened malware-ridden email
[10]Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely used logging utility
[11]UK umbrella payroll firm Giant Pay confirms it was hit by 'sophisticated' cyber-attack
We understand some of Kronos' product and services can be deployed on-premises. While there is a possibility that ransomware criminals could compromise those if the vuln they used exists in Kronos' software, rather than a network misconfiguration, in the short term, those on-prem deployments naturally won't be affected by the main Kronos shutdown.
Three years ago Kronos' US arm was [12]sued by a nursing home employee who said its fingerprint-scanning tech violated a US state's privacy laws. ®
Get our [13]Tech Resources
[1] https://community.kronos.com/s/feed/0D54M00004wJKHiSAO?language=en_US
[2] https://www.kronos.co.uk/resources/industry-brief-kronos-hr-executive-summary-manufacturing
[3] https://status.ccit.clemson.edu/incidents/329611
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/12/10/frontier_software_ransomware_incindent/
[9] https://www.theregister.com/2021/12/10/ireland_health_conti_ransomware_attack_report/
[10] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[11] https://www.theregister.com/2021/09/28/giantpay_confirms_cyberattack/
[12] https://www.theregister.com/2018/06/04/clock_blocker_woman_sues_employer_for_unauthorized_fingerprint_collection/
[13] https://whitepapers.theregister.com/
Emails sent by Kronos to its corporate customers, seen by The Register , confirm the firm has pulled its private cloud services offline following a ransomware attack. It is advising customers to deploy "alternative business continuity protocols" – a move with potential implications for Britons' Christmas pay packets.
Kronos' messages to corporate customers were identical in wording to [1]this post on Kronos' customer support forums, signed by exec veep Bob Hughes. It said:
We are reaching out to inform you of a cyber security incident that has disrupted the Kronos Private Cloud.
As we previously communicated, late on Saturday, December 11, 2021, we became aware of unusual activity impacting UKG solutions using Kronos Private Cloud. We took immediate action to investigate and mitigate the issue, and have determined that this is a ransomware incident affecting the Kronos Private Cloud — the portion of our business where UKG Workforce Central, UKG TeleStaff, Healthcare Extensions, and Banking Scheduling Solutions are deployed.
Kronos' timekeeping products are used by companies in the UK [2]including supermarket chain Sainsburys, Boots the Chemist and Jaguar Land Rover, and large outfits in the US including [3]Clemson Uni in South Carolina , USA; Winthrop University Hospital in Long Island, New York; and US state and local government customers such as Santa Clara County.
"Issues companies will have is employees don't know their schedule (it's in Kronos) and then when they clock in and out, that clock won't go anywhere," a Register reader, who works for an affected firm, told us.
[4]
Kronos' timekeeping service interfaces with companies' payrolls. In effect, it tells the payroll department how much to pay each staff member. The firm also provides rostering and shift management services.
[5]
[6]
"At this time, we are not aware of an impact to UKG Pro, UKG Ready, UKG Dimensions, or any other UKG products or solutions, which are housed in separate environments and not in the Kronos Private Cloud," concluded its statement.
The message from Kronos said restoring full service would take "several weeks."
[7]
We have asked the company for comment and will update this article if it responds.
A Sainsbury’s spokesperson said: “We’re in close contact with Kronos while they investigate a systems issue. In the meantime we have contingencies in place to make sure our colleagues continue to receive their pay.”
It is not yet known whether the Log4j remote code execution vulnerability was the attackers' way in. Neither is the attackers' identity publicly known at the time of writing.
[8]Ransomwared payroll provider leaks data on 38,000 Australian government workers
[9]Irish Health Service ransomware attack happened after one staffer opened malware-ridden email
[10]Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely used logging utility
[11]UK umbrella payroll firm Giant Pay confirms it was hit by 'sophisticated' cyber-attack
We understand some of Kronos' product and services can be deployed on-premises. While there is a possibility that ransomware criminals could compromise those if the vuln they used exists in Kronos' software, rather than a network misconfiguration, in the short term, those on-prem deployments naturally won't be affected by the main Kronos shutdown.
Three years ago Kronos' US arm was [12]sued by a nursing home employee who said its fingerprint-scanning tech violated a US state's privacy laws. ®
Get our [13]Tech Resources
[1] https://community.kronos.com/s/feed/0D54M00004wJKHiSAO?language=en_US
[2] https://www.kronos.co.uk/resources/industry-brief-kronos-hr-executive-summary-manufacturing
[3] https://status.ccit.clemson.edu/incidents/329611
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ybd8PeUA72V-Uozqdy-4vwAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/12/10/frontier_software_ransomware_incindent/
[9] https://www.theregister.com/2021/12/10/ireland_health_conti_ransomware_attack_report/
[10] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[11] https://www.theregister.com/2021/09/28/giantpay_confirms_cyberattack/
[12] https://www.theregister.com/2018/06/04/clock_blocker_woman_sues_employer_for_unauthorized_fingerprint_collection/
[13] https://whitepapers.theregister.com/
Re: Time Lords
tip pc
maybe its not the same Kronos you remember as these guys appear to be into people time management, like clock in clock out & contact centre shift pattern type stuff.
I'm not so sure they do anything with network timing, not sure anyone does anything with network timing in this day and age.
Re: Time Lords
Jellied Eel
Yup, my bad. Was thinking of Chronos (.uk). They're still going, and still very much clock rather than clock-watching focused. And still very relevant for networks. But now I'm also wondering if Kronos use Chronos for timing, and cloud-based time. NTP works ok most of the time, but not always.
Time will say nothing but I told you so,
Forget It
Time only knows the price we have to pay;
If I could tell you I would let you know.
More lines here:
https://allpoetry.com/poem/8492977-Villanelle-by-W-H-Auden
Brewster's Angle Grinder
Isn't the business case for outsourcing to hand the work to experts who'll manage the system properly rather than succumb to this kind of attack?
(I'll let them off if they've succumbed to a zero day. But not if it's a misconfiguration, unapplied patch, or other avoidable snafu.)
Time Lords
Hope they resolve it quickly. First encountered them when we had them in for a sync audit, and learned quite a lot about how to clock a network properly. Still my go-to consultants for network timing stuff.