Payroll program Kronos hit with ransomware, warns of weekslong outage

JACKSONVILLE, Fla. – If your company’s human resources department uses the program Kronos, it could take several weeks before its systems to be fully restored due to a ransomware attack.

The HR management company wrote in a memo about the incident that disrupted the “Kronos Private Cloud.” It’s suggested that companies who use its service should rely on an alternative until its fixed.

“We are working with leading cyber security experts to assess and resolve the situation, and have notified the authorities,” Bob Hughes, the company’s executive vice president, wrote in the memo. “The investigation remains ongoing, as we work to determine the nature and scope of the incident.”

Kronos said it first noticed unusual activity on late Saturday, taking action in an attempt to mitigate the issue. So far, it hasn’t been able to release a specific restoration time.

Baptist Health, headquartered in Jacksonville, said it made adjustments after learning of the malware activity Saturday. It said in a statement:

“After learning that Kronos experienced a global outage on Saturday, Dec. 11, 2021, we implemented downtime protocols to ensure payroll would continue without interruption. All team members will be paid on their normally scheduled payday on Friday, Dec. 17.”

Chris Hamer, a freelance internet networking security consultant, describes what malware is.

“A piece of malicious software that will infect your network or your machines, and it can happen a number of different ways. It’s not always the end users fault, but its success is based on either relaxed security or somebody who has way too much access,” Hamer said.

Hamer says it only takes one person clicking a bad link.

“A network, if it’s configured properly, will resist one attack, 100 attacks 1,000 attacks. It doesn’t care. It was told not to allow this access to a user. All they have to do is make one mistake. All we have to do is click one email that came from somebody that had an attachment,” Hamer said.

About the Author:

Brie Isom joined the News4JAX team in January 2021 after spending three years covering news in South Bend, Indiana.