Former Employee Brings Suit Against Hospital and HR Company Following Ransomware Attack


A class action lawsuit was filed on Wednesday in the District of Massachusetts by plaintiff Elizabeth Taylor on behalf of a putative class against defendants UKG, Inc. and her former employer Beth Israel Deaconess Hospital – Plymouth, Inc. (Beth Israel). The defendants allegedly 

On December 11, 2021, defendant UKG experienced a ransomware attack, according to the complaint. The attack resulted in the plaintiff’s personally identifiable information, as well as UKG’s Kronos Private Cloud, being rendered unusable.

The UKG Kronos Private Cloud is used by employers like defendant Beth Israel to manage their work schedules, track employee hours, and calculate employee paychecks, the complaint explains. Employee’s personal identifying information is also in the cloud, including their social security numbers, addresses, and more. With this information, the complaint explains that the plaintiff and class may be victims to “all manner of fraud.”

The UKG data breach resulted in defendant Beth Israel being unable to conduct its payroll services as usual. This meant that from the date of the breach onward, the plaintiff and class members were allegedly not paid for the full amount of time they worked.

The plaintiff said they were an hourly employee of the defendants’, providing care to the patients at Beth Israel as a registered nurse. On December 13, 2021, Beth Israel allegedly began a payment freeze for their hourly employees, meaning that “the pay for each pay period following that date was set arbitrarily to the period prior to the freeze, with limited exception.”

As a result of the freeze, Taylor contends that she did not receive the full amount of wages that she was entitled to in a timely manner, despite making numerous requests for full payment of her entitled wages. The complaint contends that the “defendants were jointly responsible for ensuring that Plaintiff and the Class were properly paid each pay period.”

Plaintiff Taylor concludes the complaint by asserting that she has incurred damages including “non-payment of wages, loss of privacy and costs of protecting their credit,” which has placed the plaintiff at “an imminent, immediate, and continuing increased risk of identity theft and identity fraud.”

The complaint cites a violation of the Massachusetts Wage Act, negligence, intrusion upon seclusion/invasion of privacy, and a breach of fiduciary duty. Taylor is seeking class certification, injunctive and declaratory relief, compensatory and general damages, reimbursement, restitution, and disgorgement, pre- and post-judgment interest, and more.

The plaintiff is represented by Finkelstein, Blankinship, Frei-Pearson & Garber LLP and McDonald Lamond Canzoneri.