The Maine Office of the Attorney General reported that UKG Inc. experienced an inadvertent disclosure of personal information on October 30, 2023, affecting 45,966 individuals, with one resident reported specifically. The breach involved exposed information such as Social Security numbers, and identity theft protection services were offered.

On February 3, 2022, the California Attorney General reported a ransomware attack affecting UKG Inc., which compromised personal information of individuals associated with PUMA North America, Inc. The breach occurred on December 11, 2021, but specific details regarding the number of individuals affected and the types of personal information involved remain unknown.

UKG Kronos Data Breach Costs State Street Bank $27.6M in Legal and Operational Fallout In a prolonged fallout from a 2021 cyberattack, human resources software provider UKG Kronos has faced criticism for its handling of a data breach that disrupted operations for State Street Bank and exposed the financial institution to legal risks across multiple jurisdictions. The incident, which left State Street without critical access to payroll and HR systems, has now resulted in reported losses totaling $27.6 million, according to filings by the bank. The breach, attributed to a ransomware attack on Kronos’ cloud-based workforce management platform, occurred in December 2021 and caused widespread outages for clients relying on the software. State Street, a global financial services firm, was among the hardest hit, experiencing prolonged system downtime that hindered payroll processing, timekeeping, and other HR functions. The disruption triggered regulatory scrutiny and potential compliance violations in regions where the bank operates, compounding financial and reputational damage. While UKG Kronos has since restored services, the incident underscores the cascading consequences of third-party cybersecurity failures in critical infrastructure. The $27.6 million figure reflects direct costs tied to remediation, legal exposure, and operational recovery, though the full scope of long-term impacts including potential litigation and regulatory penalties remains unclear. The case highlights ongoing vulnerabilities in enterprise software supply chains, particularly for organizations reliant on cloud-based HR and payroll systems.