Healthcare providers including NYU Langone University Hospital Long Island in New York and others around the world are reeling today in the wake of a reported ransomware attack on human resources services giant UKG.
The breach affects services on the Kronos Private Cloud including UKG Workforce Central, UKG TeleStaff, Healthcare Extensions, and Banking Scheduling Solutions. It is unknown if electronic protected health information (ePHI) was compromised as of posting time.
UKG Ransomware Attack Hits Healthcare Businesses Worldwide: When it Happened
The breach was discovered December 11, 2021 and customers were notified via email on December 13, 2021. In an email to affected customers, UKG stated that it may take several weeks to restore system availability. This is potentially crippling for healthcare companies as they face year-end responsibilities including completing a security risk assessment as part of becoming HIPAA compliant.
Who is Affected by the UKG Ransomware Attack?
UKG was formed in October 2020 following the acquisition of Kronos by Ultimate Software. The company has office locations throughout the world, with a network of more than 12,000 employees serving customers across 165 countries. UKG is one of the three largest HR Service companies in the world. Most of their customers are medium to large organizations.
The greatest number of people affected by the breach will be employees whose pay may be inaccurate because the time and attendance system is offline.
Healthcare Businesses affected by the Ransomware Attack should examine their recovery plans and take the appropriate steps, including assessments regarding breach notification.
Takeaways From the UKG Ransomware Attack
This breach proves that even an organization with a sterling reputation for data security like UKG can still fall victim to a ransomware attack. Healthcare providers and vendors should examine their current HIPAA compliance status and take the necessary steps to mitigate the effects of a potential breach.
