--- title: HR management provider Kronos hit by ransomware description: Kronos, the provider of workforce management and human capital management solutions, has suffered a significant ransomware attack that threatens to disrupt payroll and timesheet processing services for its customer organizations. canonical_url: https://www.acronis.com/en/tru/posts/hr-management-provider-kronos-hit-by-ransomware/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 15 December 2021 # HR management provider Kronos hit by ransomware Kronos, the provider of workforce management and human capital management solutions, has suffered a significant ransomware attack that threatens to disrupt payroll and timesheet processing services for its customer organizations. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=XkXKb_ZAWBw) Kronos, the provider of workforce management and human capital management solutions, has suffered a significant ransomware attack that threatens to disrupt payroll and timesheet processing services for its customer organizations. Kronos is one of the largest HR management companies, and boasts an annual revenue of over $1 billion. Its list of prominent customers includes Tesla, Community Bank, and the San Francisco Municipal Transit Authority. Services using the Kronos Private Cloud have been taken down completely, with their UKG Workforce Central, UKG TeleStaff, and Banking Scheduling solutions all being affected. It's possible that attackers used [the Log4Shell vulnerability](https://www.acronis.com/en-us/cyber-protection-center/posts/critical-apache-log4j-vulnerability-discovered-heres-what-you-need-to-know/) to breach Kronos' system, or they may have gained access via other means. Acronis Cyber Protect's suite of tools makes it easy to automatically patch protected systems against the latest vulnerabilities, as well as stopping both known and unknown ransomware variants in their tracks with its built-in Active Protection. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)