LIRR union leader concerned about employees getting paid after cyberattack

An LIRR union leader raised concerns Tuesday about potential payroll disruptions, after learning that the MTA’s Kronos timekeeping system had been attacked by cybercriminals over the weekend.

Ultimate Kronos Group, an HR management company contracted by the Metropolitan Transportation Authority in 2019 to install biometric clocks that track employee hours and help curb unauthorized overtime pay, was hit with a ransomware attack on Saturday, a company spokesperson said. Also attacked was Kronos Workforce Central, which manages time, attendance and more.

In an online post to customers, Ultimate Kronos Group, which handles other high-profile clients including Tesla and Puma, said it was trying to determine whether any data had been breached. It could take weeks to resolve the issues, the company said in an online post.

"We took immediate action to investigate and mitigate the issue, have alerted our affected customers and informed the authorities, and are working with leading cybersecurity experts," Erik Carlson, a spokesperson for the group, wrote in an emailed statement. "We recognize the seriousness of the issue and have mobilized all available resources to support our customers and are working diligently to restore the affected services."

Anthony Simon, general chairman of the International Association of Sheet Metal, Rail, and Transportation workers, the Long Island Rail Road’s largest union, fears the cyberattack could wreak havoc on his members.

"Now, thousands of workers during the middle of the holiday season will not be paid properly if at all, and all of the year-end payouts and adjustments will not take place," Simon said. "Who will be investigating that?"

An MTA spokesperson said employees will be receiving their paychecks, but did not dismiss the potential for a delay in overtime pay.

"We have complete confidence that we will be able to determine how many hours employees work and pay them for those hours, and we continue to ask employees to keep time the way they always have," said Tim Minton, a spokesman for the MTA. Minton stressed that the agency is continuing to evaluate and assess the full impact of the incident and is instructing employees to continue swiping in and out of Kronos.

In an MTA memo obtained by Newsday, the agency notified employees on Tuesday night that the transit agency was one of many entities targeted in a Kronos ransomware incident that caused a "global outage."

"MTA Payroll is implementing contingency plans to ensure that there is minimal impact to regular payroll during this outage. In some cases, special payment, overtime hours, or other paid leave adjustments will be made in subsequent payrolls as necessary, but we want to assure everyone that you will be paid for all time worked," the memo states. The memo further clarifies that only employees that use Kronos swipes, which includes managerial, part-time employees and administrative staff, will be affected. It's unclear how many employees actually log in and out with the new clocks.

Ultimate Kronos Group said online that its "timeclocks will record and store employee time-punches offline until connectivity can be restored … However, UKG strongly recommends customers engage in manual time collection efforts to ensure accurate collection of employee time in the interim."

The FBI declined to comment on whether it was investigating.

In early December, the MTA's inspector general found that not all workers were using Kronos and that timeclocks weren’t linked with the agency’s computerized time system as part of the agency's overtime reform.

The MTA began to cut overtime costs after a 2019 payroll report by the Albany-based, nonpartisan Empire Center of Public Policy revealed alarming overtime rates, sparking several investigations into fraud and abuse.

With Alfonso A. Castillo