UKG Kronos Private Cloud Status Updates

Additional Information Regarding Recent Cybersecurity Incident

As of January 22, all affected customers in the Kronos Private Cloud have been restored with safe and secure access to their core time, scheduling, and HR/payroll capabilities. We are now focused on the restoration of supplemental features and non-production environments for impacted customers.

Receive Update Notifications by Email*

Get the latest updates sent to your inbox.

 

Frequently Asked Questions

Read up-to-date Q&A for impacted customers.  

 

 

All UKG Kronos Private Cloud Updates

 

 

*Upon subscribing, please click the link in the confirmation email from [email protected] If you do not receive this email, please check your spam filter.


Incident Summary

On December 11, 2021, we became aware of unauthorized activity impacting UKG solutions using Kronos Private Cloud. We took immediate action to investigate and mitigate the issue and determined that it was a ransomware incident affecting the Kronos Private Cloud—the environment where some of our UKG Workforce Central, UKG TeleStaff, Healthcare Extensions, and Banking Scheduling Solutions are deployed.

It is important to note that at this time, we are not aware of an impact to:

  • On-premise (self-hosted) UKG Workforce Central customers
  • On-premise UKG TeleStaff customers
  • UKG Pro
  • UKG Dimensions
  • UKG Ready
  • UKG HR Service Delivery (People Assist and Document Manager)
  • Any other UKG products or solutions that are housed in separate environments and not in the Kronos Private Cloud

These solutions listed above remain available.

Since the initial attack, we have made significant progress in our recovery process. Our teams have been working continuously to bring customer systems back online as quickly and securely as possible. We are extraordinarily grateful for the patience and partnership our customers have shown throughout this process.

As of January 22, all affected customers in the Kronos Private Cloud are restored with safe and secure access to their core time, scheduling, and HR/payroll capabilities. We are now focused on the restoration of supplemental features and non-production environments for impacted customers.


Status Update as of April 7, 2022

Dear Kronos Private Cloud Customers –

KPC Recovery Progress Update

We previously shared that the first phase of our restoration process was completed on January 22, which means all KPC customers have secure access to their core functionality – namely, time, scheduling, and HR/payroll capabilities.

Since that time, our team has been diligently focused on restoring the additional applications that some of our KPC customers use as a part of their UKG solutions, such as Citrix, Workforce Analytics, and non-production environments. An update on the status of this second phase of restoration is as follows:

  • ODBC restoration is now complete for all customers who used ODBC prior to the incident.
  • Teletime and Extensions for Healthcare restorations are now complete.
  • Citrix access for production environments has been restored to all customers who leveraged Citrix prior to the outage.
  • Our target to complete restoration of Workforce Analytics for customers who were actively using this feature prior to the incident is mid-April.

We are focused on getting through this second phase as quickly as possible, and we have resources working around the clock to restore these additional capabilities by the end of this month.

Forensic Investigation Update

Our forensic investigation is now complete. As previously communicated, the investigation determined that the personal data of individuals associated with two of our customers was exfiltrated as a result of the incident.  Both affected customers have been notified, and we have worked with those customers to ensure that affected individuals have also been notified and offered appropriate protections. If your organization has not heard directly from us, you can feel confident that we have found no evidence that any personal data of individuals associated with your organization was exfiltrated.  

Thank you for your ongoing support and understanding as we complete the final phase of restoration and recovery.