Data of +6K Puma employees stolen in December Kronos Ransomware attack

Data belonging to 6,632 Puma employees was stolen in a December 2021 ransomware attack that hit Ultimate Kronos Group (UKG).

Data of 6,632 Puma employees was stolen in a ransomware attack that hit HR management platform Ultimate Kronos Group (UKG) in December. Potentially exposed data includes names, Social Security numbers, and other personal information.

The attack hit the Kronos Private Cloud service used to host multiple cloud applications, including Banking Scheduling Solutions, Healthcare Extensions, UKG TeleStaff, and UKG Workforce Central.

Puma was one of the customers of the company that were impacted by the security breach.

“UKG Inc., and its affiliates and subsidiaries (collectively, “UKG”, “Kronos” or “we”), is a workforce and human resource management services company that provides services to PUMA North America, Inc. (“PUMA”).” reads a notification letter sent by UKG to the impacted individuals.

“Regrettably, this letter is to inform you that we were recently the victim of a ransomware attack that involved some of your personal information, which was provided to us in connection with the services we provide to PUMA,”

Kronos confirmed that a threat actor had unauthorized access to the cloud-based environment earlier in 2021, and stole data before encrypting the infrastructure.

Kronos discovered the theft of personal data on January 7, 2022, and notified the company of the incident on January 10.

“Since the attack was discovered, Kronos has been conducting a comprehensive review of the impacted environment to determine whether any individual’s personal information was subject to unauthorized access or acquisition. On January 7, 2022, Kronos confirmed that some of your personal information was among the stolen data. We notified PUMA of this incident on January 10, 2022.” continues the letter.

The company has notified the authorities and is working with leading cybersecurity experts to assess the extent of the incident.

To help prevent similar security breaches from happening in the future, Kronos is implementing additional security measures to increase the level of cyber security.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Puma)