Kronos, a leading provider of workforce management and HR solutions (under UKG), suffered a severe ransomware attack that crippled its Kronos Private Cloud, disrupting critical services like payroll processing, timesheet management, and workforce scheduling for major clients, including Tesla, Community Bank, and the San Francisco Municipal Transit Authority. The attack forced a complete shutdown of key platforms—UKG Workforce Central, UKG TeleStaff, and Banking Scheduling—halting operations for countless organizations reliant on these systems.The incident suggests potential exploitation of the Log4Shell vulnerability (or alternative breach methods), leading to system-wide outages that threatened financial stability, operational continuity, and employee/customer trust. Given Kronos’ role in payroll and HR data management, the attack likely compromised sensitive employee and organizational data, while the prolonged service disruption risked financial losses, reputational damage, and regulatory penalties for affected businesses. The scale of the attack—targeting a $1B+ revenue company—highlights its destabilizing potential for dependent industries, including public transit, banking, and manufacturing.

The Colorado Attorney General's Office reported a data breach involving Kronos, a payroll software vendor used by Vail Health, on January 14, 2022. The breach was due to a ransomware attack, but it is currently unknown whether any personal information was accessed or compromised. The types of information potentially involved include names, addresses, dates of birth, social security numbers, and bank account information.

A well-known payroll company Kronos was hit by a ransomware attack in December 2021. The attackers broke into a system, encrypted the data, and kept its payroll software offline leading to a delay in the paychecks of hundreds of businesses' staff. The staff details of the companies were compromised in the attack and the attackers demanded a huge sum of money as a ransom.