2021 UKG/Kronos Private Cloud — ransomware; multi-week payroll/workforce SaaS outage (Dec)
Data compromised
Payroll and workforce-administration data categories in customer tenants per downstream notices—varies by employer
Technical writeup
Ultimate Kronos Group (UKG) publicly confirmed that Kronos Private Cloud (KPC) and affiliated cloud workforce suites were hit by ransomware over the December 11–13, 2021 weekend, forcing an extended outage of hosted HR/payroll/timekeeping services used by thousands of downstream employers. Trade reporting (BleepingComputer, Dark Reading, sector advisories such as H-ISAC/AHA summaries) documented cascading payroll continuity problems and later, customer-specific follow-on exposure narratives (e.g., employers notifying employees after theft from the vendor environment). Consolidated natural-person victim totals were not uniformly published at vendor level; treat employee-record figures as customer-reported where cited.
Root cause
Ransomware compromise of Kronos Private Cloud hosting (vendor-confirmed)