Kronos went down; the duty to pay public workers on time stayed up

The week

On December 11, 2021, Ultimate Kronos Group, the workforce management company known as UKG, became aware of a ransomware attack affecting its Kronos Private Cloud. The hosted service supported timekeeping, scheduling and related functions for many employers, including local governments, public transit systems, hospitals and private companies. UKG told customers the service could be unavailable for several weeks. Affected employers had to track hours and run payroll by other means during the holiday period, while security teams everywhere were also responding to the Log4j vulnerability disclosed days earlier. Restoration took weeks, with customers brought back progressively into late January 2022. Employees at some affected employers reported missing or incorrect pay, and lawsuits followed.

Cloud services are bought, in part, to transfer operational burden. The vendor runs the infrastructure, applies patches and handles backups. For most organizations that improves resilience. The Kronos incident showed where the transfer stops. When the service went down, the vendor had to restore its platform. Each employer still had to pay its staff accurately and on time, under wage and hour laws and labor agreements that did not pause. Public employers with large hourly, shift-based workforces, such as police, fire, transit operators, corrections officers and public hospital nurses, carried the heaviest load. We look at three obligations that stayed with the employer: producing paychecks, keeping the time record, and meeting legal and contractual duties.

Producing paychecks

The first problem was immediate. Payroll systems needed approved hours to calculate pay, and those hours sat in the unavailable service. Employers chose among imperfect options. Some paid each employee the same hours as a prior period. Some estimated hours from published schedules. Some reconstructed actual hours from paper and spreadsheets. Paying prior-period hours was fast but wrong for anyone whose hours had changed, which in December, with holidays, overtime and illness, was many people. Reconstruction was accurate but slow.

The choice depended on data the employer held outside the vendor’s platform. An employer with a recent export of schedules, pay rules and employee assignments could estimate pay sensibly within days. One without it was guessing. The useful export is modest: current schedules, each employee’s pay rules and differentials, accrual balances and the last few periods of approved time. Held in a secure location the employer controls and refreshed every pay period, it turns a vendor outage from a blind spot into a manual process with known inputs.

Employers that had written and rehearsed a manual payroll procedure moved quickly. Those designing one during the outage lost time, and some paid people incorrectly. Public employers faced added scrutiny, since pay errors for police officers, transit workers and nurses became local news within days.

Keeping the time record

The second problem was the record. Even if paychecks went out, hours worked during the outage had to be captured somewhere. They would need to be reconciled against pay already issued, and they formed the legal record of time worked. Employers turned to paper timesheets, spreadsheets, badge system logs and supervisors’ notes. When the service returned, that data had to be entered or imported, checked and reconciled.

Reconciliation was the long tail. Underpayments had to be corrected promptly. Overpayments had to be recovered carefully, within the limits of state law and labor agreements on deductions from wages. Overtime had to be recalculated across workweeks that spanned the outage. Leave accruals had to be brought back into line. For a large public employer with many job classifications, differentials and pay rules, this took far longer than the outage itself. It also consumed payroll and HR staff at year end, when tax forms are due.

Planning for reconciliation is part of continuity planning. That means a standard format for outage-period time capture that maps to the import format of the timekeeping system, a rule for who approves reconstructed hours, and a target date for completing true-up after restoration. It also means deciding in advance how corrections will be communicated to employees, since a clear notice prevents grievances that a surprise deduction will cause.

Meeting legal and contractual duties

The third problem was compliance. The Fair Labor Standards Act applies to state and local government employers and requires that non-exempt employees be paid at least the minimum wage and overtime for hours worked, on the regular payday. Many states add their own rules on pay timing and final pay. Public sector labor agreements often add shift differentials, call-back pay, holiday premiums and penalties for late payment. None of these duties was suspended because a vendor was down. Employees at several affected employers later brought claims over late or incorrect pay. Organizations should check with counsel on their specific obligations, which vary by state and agreement.

Contracts mattered too. Many employers found their agreements with the vendor said little about outages of this length. Typical terms covered availability targets and service credits, which are small against the cost of manual payroll and legal exposure. Few addressed customer access to its own data during an incident, timelines for restoring service, or support for the reconciliation work afterward. Those are reasonable asks at renewal for any service whose loss would stop the organization meeting a legal duty.

Concentration added a regional dimension. Many public employers in the same area used the same service, so neighboring cities, a transit authority and a county hospital could all be affected at once. That limits mutual aid between peers and stretches local payroll consultants. Knowing which critical functions share a single vendor with neighboring jurisdictions helps emergency managers plan for a correlated outage, not just a local one.

With hindsight

The Kronos incident became an early reference case for a pattern that recurred. In 2024, the attack on Change Healthcare disrupted claims and payments for providers across the country, and an attack on CDK Global took down dealer management software for thousands of auto dealerships. The same year, a faulty security software update caused widespread outages on Windows systems. Each time, the organizations that recovered best had treated vendor dependencies as their own continuity risks, with data exports, manual procedures and tested fallbacks. Many public employers affected in 2021 revised their continuity plans to cover payroll and scheduling explicitly. By this point in 2026, regulators in several sectors expect outages at critical third parties to be part of resilience testing. A vendor can run the system. It cannot hold the employer’s obligations.