Ultimate Kronos Group (UKG) Security Incident

Newsletter Articles May 5, 2022 BEWARE OF PAYROLL SOFTWARE HACKS! By Gardner Skelton Cyber-attacks are becoming more common as employers depend on new technology. Without the proper protections in place, employers could be faced with massive lawsuits. On December 11, 2021, Ultimate Kronos Group (UKG), a Florida-based HR management software company, discovered a ransomware attack on one of their cloud-based time and attendance systems. The hack resulted in outages across the system for weeks, affecting over 2000 companies, from hospitals to government agencies. The data breach forced employers to manually track employee time and caused difficulties managing end-of-year vacations and payroll and bonus calculations. Although UKG restored most system capabilities within about six weeks, concerns remained over whether the breach left employee information exposed and whether some employers had violated the Fair Labor Standards Act (FLSA). Since January 19, 2022 lawsuits have been filed against employers in connection with the security breach. The employees claims vary from recouping back wages and overtime pay (due to unrecorded working hours during the breach and the additional time employees spent tracking their hours) to security-based claims over the employers failure to adequately protect employees private information, such as their social security numbers. What can employers do to protect themselves in the event their third-party vendor is hacked? Employers faced with potential claims arising out of their third party vendors security breach may have a good faith defense if they take certain measures to ensure the security of third party vendors. To help minimize risk, employers should: Ask their third party vendors whether they conduct regular security assessments. Security assessments should, at minimum, identify potential risks, estimate the likelihood and potential impact of those risks, and implement specific protections against t hose risks. Make sure...

... (truncated for display)