Ultimate Kronos Group has disclosed that it became aware on December 11th of “unusual activity” affecting its private cloud service which turned out to be a ransomware attack.

Many companies, such as Sainsbury’s, use Kronos to log, store and process the hours employees have worked. In the case of Sainsbury’s, around a weeks worth of data was lost which has caused disruption, although the supermarket giant has said that employees will be paid before Christmas.

A Sainsbury’s spokeswoman said: “We’re in close contact with Kronos while they investigate a systems issue. In the meantime, we have contingencies in place to make sure our colleagues continue to receive their pay.”

Not all companies have such a contingencies, however, and given the breadth of the attack and loss of data to payroll and scheduling, many may experience wage disruption in the coming weeks. Many companies have turned to historical data and working patterns to try and discern how to pay their employees.

---

Recommended

• Kaspersky uncovers mass ‘spyware campaign’
• Scottish Enterprise backing for project to to protect software supply chain
• Scottish NeuroMotor pen gains FDA Breakthrough Device Designation

---

In a statement, the company said: “Given that it may take up to several weeks to restore system availability, we strongly recommend that you evaluate and implement alternative business continuity protocols related to the affected UKG solutions.”

This is the latest in a string of high profile ransomware attacks this year, with the National Cyber Security Centre saying that its threat is now potentially as harmful as state-sponsored espionage.

In a comment about the attack, Jude McCorry CEO at Scottish Business Resilience Centre said: “There is never a good time for an organisation to suffer a cyber-related incident – however, it can be particularly painful as Christmas approaches; especially when it directly hits the pockets of employees.

“With teams due to wind down for the year and ongoing staffing challenges due to sickness and general fatigue, the result is potentially fewer people on the ground which are the perfect conditions for cyber criminals to pounce; it’s a trend we are increasingly seeing in the industry and is the case with UKG.

“To mitigate such attacks all year round, organisations must be clued up on their cyber-processes. Ensuring incident response plans are in place and up to date is the first step – as well as ensuring staff are prepared to react calmly and rationally.

“Preparation is key, and in reviewing plans, teams must also identify any weak links in the company armour and take immediate steps to ensure data is secure, backed up and protected. The important approach for organisations to follow is the ‘3-2-1’ rule, whereby there are at least 3 copies of data that can be accessed on 2 devices and at 1 offsite backup.”

Global ransomware attacks hit a record 305 million in the first six months of this year. And, according to the DCMS Cyber Security Breaches Survey published in March, 39% of all UK businesses (2.3m) reported a cyber breach or attack in 2020/21.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

We will keep you up to date on the pivotal issues impacting the sector and let you know about key upcoming events to ensure that you don’t miss out on what’s going on across the Scottish tech community.

Click here to subscribe.