When a ransomware attack left Rich, a Coca-Cola delivery driver and salesman in Charleston, West Virginia, without a paycheck at Christmas, he made do.
But since then, things haven’t gotten much better. Rich, who asked not to be identified by his last name for fear of retaliation from his employer, is among hundreds of workers who deliver Coke products in at least three states who say they’re still owed wages — fallout from one of the many ransomware attacks that hit U.S. companies practically every day.
Rich, a father of three, said he’s had to dip into his savings, which have dwindled down in recent weeks.
“They went from $1,100, $1,200 a week to $300, $600,” he said of his paychecks. “I got one $300 paycheck, and I called and told them exactly what I needed paid, and they sent me a $46 check.”
More than a month after hackers crippled Kronos, a payroll and staffing company that has become integral to many American workplaces, paychecks to employees in Indiana, Ohio and West Virginia who work for Coca-Cola Consolidated, an independent company that serves as the country’s largest distributor of Coke products, have been sporadic, according to union representatives.
“We’ve got 130 people and they’ve all got problems,” said Max Zemla, the president of the Cleveland-area Teamsters Local 293. “Some are telling me they’re not as bad off. I have a guy who’s off a thousand dollars. Uses his money for his kid’s tuition for school, and he’s not able to pay it.”
A spokesperson for Kronos noted that the company announced on Jan. 22 that it had finally restored all its services. Josh Gelinas, Coca-Cola Consolidated’s vice president of communications, said that the company “has continued to pay all of our teammates despite a ransomware attack in December that disabled digital timekeeping for us and thousands of other companies around the world.”
“The timekeeping vendor Kronos that suffered the attack is in the process of coming back online,” Gelinas said in an emailed statement. “But, until these digital systems are fully restored, we must continue manually recording work hours for thousands of our teammates. This process is taking longer than we would like and may have resulted in some inconsistencies, but our teammates will be paid for every hour they’ve worked.”
Workers have not complained of similar problems at the Coca-Cola Co., which makes Coke products.
Ransomware cost American businesses almost $20 billion in damages last year, according to a study by the cybersecurity company Emsisoft. For many ransomware victims, if the hack is severe enough, either using the hackers’ program or restoring their own networks on their own can be a laborious, weekslong process.
But beyond the corporate cost, ransomware attacks are starting to wear on the American public. Hackers don’t only target large corporations for big paydays, but also schools and police departments, and increasingly harass everyday people to convince victims to pay.
“It’s often assumed that ransomware mainly affects governments and major corporations because it’s those incidents that make the news,” said Brett Callow, a ransomware analyst at Emsisoft.
“The reality, however, is that more than half of all ransomware victims are small businesses and individuals. And, unfortunately, they are usually not as well prepared to deal with the problem as larger organizations and probably feel more pain as a result.”
Ransomware hackers hit Kronos in mid-December, a particularly sensitive time for a payroll company. A host of state and local government agencies, as well major corporations like Whole Foods, GameStop and Honda, use Kronos to organize employees’ shifts and paychecks. Many American companies that used Kronos moved to a system that sent employees a regular paycheck based on their previous wages.
Jeff Combs, the secretary treasurer of Teamsters Local 135 in Indianapolis, said the vast majority of the roughly 200 Coca-Cola Consolidated employees he represents are still owed pay.
“Some are still owed as high as $4,700,” Combs said.
As for Rich, he said he had saved enough to survive missing some pay, but was upset that his employer wasn’t able to immediately come up with payments for workers.
“I hated to dip into my savings,” he said. “But now my savings have dwindled down because a billion-dollar company can’t give you an average paycheck.”