Lawsuit Alleges UMass Memorial Employees Deprived of Timely Wages Following Kronos Data Breach [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class and collective action claims the University of Massachusetts Memorial Medical Center has failed to pay employees timely and accurate wages in the wake of a December 2021 data breach that crippled the healthcare system’s payroll vendor.

According to the 37-page suit, Kronos Incorporated, UMass Memorial’s payroll services provider who is also named as a defendant, was the victim of a ransomware attack that resulted in a “massive data breach” on December 11. The lawsuit alleges that the personally identifiable information of over eight million employees was compromised in the breach, exposing them to an “immediate and heightened risk of all manners of identity theft.”

Moreover, the Kronos Private Cloud, through which many of the company’s clients maintained and distributed payroll to their employees, was rendered inoperable as a result of the breach, causing UMass Memorial to initiate a “payment freeze” for all hourly workers, according to the suit. The case alleges the healthcare system, one of the largest in Massachusetts, has unlawfully paid workers according to a pay period prior to the freeze, causing many to be paid for “far fewer hours” than they actually worked, or not at all.

The lawsuit alleges that the defendants “negligently” failed to take reasonable steps to protect employees’ personally identifiable information (PII) from unauthorized access and then robbed them of timely wages in the wake of the December 2021 data breach.

“By disclosing their PII to cybercriminals, Defendants caused Plaintiffs and all Class Members not to timely receive the pay to which they were entitled and put Plaintiffs and all Class Members at risk of identity theft, financial fraud, and other serious harms,” according to the complaint.

The plaintiffs in the lawsuit say they worked for UMass Memorial as registered nurses at the time of the Kronos data breach. According to the case, UMass Memorial stored the plaintiffs’ and other employees’ names, addresses, employee ID numbers and Social Security numbers in the Kronos Private Cloud. The lawsuit alleges that due to Kronos’s “inadequate security measures,” the company was the subject of a December 11 ransomware attack  during which its payroll system was rendered inoperable and employees’ private information was exposed.

Two days later, on December 13, UMass initiated a “payment freeze” for all hourly employees and thereafter paid the workers in accordance with a pay period “arbitrarily” set before the freeze, the case relays. As a result, many workers have not been paid for the full amount of time they worked or were not paid at all, the suit says. The plaintiffs claim to have made “numerous requests” for the full amount of the wages they are owed yet have been denied.

According to the lawsuit, the defendants have failed to adequately compensate data breach victims who were “harmed by [their] negligence.” The suit says workers have not been offered free credit monitoring, assistance with dealing with the IRS or state tax agencies, reimbursement for the costs of fraudulent tax returns, or compensation for injuries caused by not receiving timely paychecks.

The lawsuit proposes to cover all hourly employees of UMass Memorial, anyone who received less than their full wages as a result of the Kronos data breach, and anyone whose personally identifiable information was compromised as a result of the Kronos data breach announced on or about December 11, 2021.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.