Nurses Receive Partial Pay After Ransomware Attack Shuts Down Payroll

Ransomware attacks can bring hospitals and other healthcare facilities to a grinding halt. Hackers may hold digital files or databases for ransom. In other cases, an attack can cause the entire EHR or billing system to collapse, leaving administrators scrambling to find a solution.

That’s what happened to the nurses at Amita Health St. Joseph’s Medical Center in Joliet, Illinois. They say the company that handles their paychecks has been hit with ransomware. And now they’re not getting paid when they need that money most.

Going Offline

The staff at the suburban hospital just outside of Chicago say the attack is affecting thousands of healthcare workers, including nurses. Many providers are only receiving partial pay until the issue can be resolved.

“It’s overwhelming,” nurse Colleen Dial said. “If you ask any of the COVID nurses, it’s worse than it was two years ago for us.”

A group of nurses affected by the outage recently got together to discuss the challenges they’ve been facing now that they’re not getting paid the full amount, even as the number of COVID-19 cases continues to soar.

The event was originally named “New Year’s Rejuvenation”. It was designed to help healthcare workers relax and recover from the stress of the holidays, but now these nurses have a new issue to contend with.

Dial said dealing with the current surge in new cases was hard enough, but not getting paid only makes it more difficult for her to do her job.

“Each one (of my checks) has been about $400 less,” she said. “There’s not backup. HR should have been there to make it right.”

The attack on Ultimate Kronos Group’s payroll system isn’t limited to just Joliet. The company serves facilities all over the country and nurses are feeling the heat. The disruption first occurred back in December. Many providers had to go without full pay during the most expensive time of the year. Administrators told staff to keep track of their hours until the issue can be resolved.

According to Patricia Meade, a board member of the St. Joseph’s Nurses Association, “Ideally, by the next pay period everyone should be caught up. But that’s thousands of papers you fiddle through. I can’t imagine that will happen.”

Meade said the situation has been “catastrophic” for nurses. She doesn’t know a single provider that hasn’t had to dip into their savings account to make ends meet.

“It’s extra hard,” Dial said. “Everything is so expensive out there. Prices have gone up. Some nurses and aides are single parents. I don’t know how they’re going to make it right.”

Ultimate Kronos Group, which is considered one of the largest payroll firms in the country, services many different types of companies and organizations, including New York’s Metropolitan Transportation Authority, Tesla and MGM Resorts International.

Employers all over the country have had to come up with contingency plans to make sure their workers get paid. Some have switched over to paper checks, but many organizations say they can’t access payroll at all. The company first became aware of the attack when it noticed some “unusual activity” on its servers. Officials said the system could be down for several weeks or more.

“UKG recently became aware of a ransomware incident that has disrupted the Kronos Private Cloud, which houses solutions used by a limited number of our customers. We took immediate action to investigate and mitigate the issue, have alerted our affected customers and informed the authorities, and are working with leading cybersecurity experts,” a Kronos spokesperson told reporters.

“We recognize the seriousness of the issue and have mobilized all available resources to support our customers and are working diligently to restore the affected services,” they went on to say.

The company’s clients are also concerned the hack could expose sensitive information about their employees. When asked for comment, UKG said the “investigation is ongoing, and we are working diligently to determine whether customer data has been compromised.”