[BreachExchange] W.Va. state employees work overtime on Christmas to overcome ransomware attack

[Terrell Byrd]

https://www.msn.com/en-us/news/politics/w-va-state-employees-work-overtime-on-christmas-to-overcome-ransomware-attack/ar-AAScUX8

More than 37,000 state employees will get their paychecks this Friday,
after payroll administrators worked through the holiday weekend to overcome
a recent ransomware attack.

While most of were celebrating the holiday weekend with friends and family,
many West Virginia state workers were putting in extra hours at the capitol
to make sure 37,000 state employees would get paid this Friday.

"They worked thousands of hours of overtime," state auditor JB McCuskey
said. "Many of them worked on Christmas day, Christmas Eve, the day after
Christmas, Saturday, Sunday. It was a true personification of what public
service means."

On Dec. 11, the state's payroll software, UKG -- better known as Kronos --
was knocked offline by a ransomware attack.

McCuskey said the cyberattack didn't affect any employees' personal
information or data, but the amount of hours each person worked during the
pay period and how much time off they have accrued had to be reentered by
hand because of the attack.

The auditor's office is planning to sue Kronos.

"On Friday, what people will see is that the payroll is going to run,"
McCuskey said. "And I think that's really a testament to a whole bunch of
people's really hard work. And they should all know that our office is
going to make sure Kronos is held accountable for what they did, and for
all the extreme expense and annoyance this has caused throughout state
government."

The auditor's office is now asking workers to check their paystubs for any
mistakes, so the administrators have time to fix them before Friday.

"What we need them to do is go into ESS and check that the amount they're
being paid is correct," McCuskey said. "And if it's not, we've opened up
our system and sort of bolstered up some of our processes by which their
payroll administrator can then send us a modification. And we can cut a
paper check that will be delivered to them prior to Friday or on Friday."

McCuskey said the state's Enterprise Resource Planning board went into
action immediately, working to resolve the issue. He said he expects the
cyberattack will affect at least the next two pay periods.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20211228/becf84a8/attachment.html>