A years-old ransomware attack is back in the spotlight as State Street Bank takes aim at its former human resources software provider in the Kronos Data Breach $27.6M suit, filed Friday in Massachusetts state court.

The financial services giant alleges that UKG Kronos failed to properly respond to a 2021 cyberattack that crippled payroll systems, exposed employee data and left State Street entangled in regulatory risks across 22 countries.

Alleged Breach of Master Services Agreement

The complaint, lodged in Suffolk County Superior Court, contends that UKG Kronos’ handling of the breach violated a 2015 master services agreement between the companies.

According to the filing, the ransomware incident compromised employees’ personal information and effectively locked approximately 85% of State Street’s global workforce out of UKG Kronos systems for 23 months — nearly two years of operational disruption.

Without access to core HR functions, including reporting overtime, tracking hours worked, managing paid time off and processing leave requests, State Street says it could not meet regulatory reporting obligations in most of the 22 nations where it operates.

The fallout, the bank argues, went far beyond inconvenience. It exposed the institution to legal and compliance risks on multiple fronts.

Substitute Systems and Mounting Costs

State Street asserts it was forced to spend heavily on replacement products and services to maintain payroll and reporting operations. The lawsuit claims UKG Kronos failed to timely mitigate or remediate the consequences of the breach and did not promptly deliver a report necessary for State Street to comply with international regulations.

The complaint alleges that UKG Kronos only completed that required report after State Street terminated the master services agreement — six months after the ransomware attack struck.

State Street further maintains that the 2015 contract obligated UKG Kronos to maintain an adequate disaster recovery plan before any breach occurred and to provide immediate notification to customers in the event of such an incident. The bank contends those obligations were not fulfilled.

“Despite Kronos’ material breaches of the agreement and State Street’s termination for cause, Kronos has not, to date, refunded State Street for its prepaid fees under the agreement,” the complaint states.

$27.6 Million in Claimed Damages

State Street estimates it has incurred $27.6 million in direct damages and costs stemming from the disruptions and the need to secure replacement systems.

The lawsuit marks the latest chapter in a series of legal actions following the 2021 hack. Previous cases have included claims by employees of companies using UKG Kronos’ software-as-a-service platform, as well as suits brought directly by employers.

Messages seeking comment from counsel for State Street and a spokesperson for UKG Kronos were not immediately returned Monday.

State Street Bank and Trust Co. is represented by Sean T. Carnathan of O’Connor Carnathan & Mack LLC and Richard Donoghue, Edward Cavasos and James Quail of Pillsbury Winthrop Shaw Pittman LLP.

Counsel information for UKG Kronos was not immediately available.

As litigation unfolds, the Kronos Data Breach $27.6M suit serves as a stark reminder that in the digital age, a single cyber intrusion can reverberate across continents — and through courtrooms — long after the initial breach.