Some Cheyenne Regional employees upset by handling of Kronos hack

·9 min read

Apr. 10—CHEYENNE — Some employees say Cheyenne Regional Medical Center and its overall health system did not adequately handle an outage that affected its timekeeping and payroll software.

The Wyoming Tribune Eagle reported March 26 that more than 2,000 CRMC employees were affected when its human resources management system, Kronos Private Cloud, went down Dec. 11 after a larger-scale ransomware attack.

The WTE spoke with three Cheyenne Regional employees who reached out after that story was published. They did not want to be identified because they said they fear retaliation from the hospital.

These employees were frustrated largely because of what they felt was management not being readily available while the system was down. In some cases, they questioned the accuracy of their pay, mainly because it was unclear to them how their paychecks were calculated during the outage.

They claimed that the payroll department was understaffed, and said they felt devalued by certain responses to their frustrations. These workers said they are paid by the hour.

While Kronos was down, the health system's payroll department manually processed paychecks over five pay cycles, Chief Human Resources Officer Joanna Vilos said previously. Vilos says about 55% of Cheyenne Regional employees were overpaid, while about 45% were underpaid.

"One of our top priorities was to ensure paychecks were issued timely on each and every payday, which we successfully accomplished," Vilos said in a Thursday statement to the WTE.

Kronos says the core functionality of its payroll software, including "time, scheduling and HR/payroll capabilities," was restored by Jan. 22. Cheyenne Regional says the software became fully functional in early March, and Vilos said that when the hospital could access the payroll system, it "immediately began reconciling all employees' paychecks."

Those who were underpaid received the money they were owed in their March 17 paycheck, an employee said.

Vilos says no personal information was compromised, thanks to the health system's "robust set of policies and practices against cyberattacks."

Payroll department

Employees said just two people staffed the health system's payroll department during the Kronos outage.

In her Thursday statement, Vilos confirmed the payroll team was staffed with two full-time employees, saying it was "supplemented with ongoing assistance from human resources, accounting and administrative staff."

"I feel like a lot of the over- (and) underpayment stuff could have been prevented if maybe they would have contracted in some outside help, instead of dumping this onto employees," said a staffer. "We were getting messages of 'Don't call payroll, they're very busy. They'll set up a room in one of the conference rooms on such and such day from such and such hours. If you have questions, do it then.'"

Since Kronos came back online, the employee said, they've been asked to schedule meetings with the payroll department.

Staff said there were several email communications from hospital leadership, but that some aspects were difficult to understand. Employees perceived the messaging as not transparent.

"This is a widespread concern within the organization, and there are a lot of unhappy employees," one hospital worker said. "There's a lot of inconsistencies with what they're saying, and I think that's one of the primary reasons people are upset is that we're not getting straightforward answers."

When one employee scheduled an in-person meeting with a payroll department employee, the hospital worker said she wanted to find out more from payroll about how they'd determined paycheck amounts. According to this hospital worker, payroll did not have information about individual employees' insurance deductibles, or even pay scale, during at least part of the outage.

"I told (the payroll department employee) that I really wanted to double check and make sure that everything matches up, everything aligns, before I pay anything back, and she said, 'I will make a note to the VP that you are refusing to pay back the money you owe,'" the hospital worker recalled. "I told her that is not what I said, and later on, she retracted that statement, saying she had never said that. So I did, I got a little riled up with her because I felt that was inappropriate and she was setting me up."

The employee said she was told that if she did not pay back the money she was told she owed, the amount would be sent to collections.


In communications from the health system, an employee said, hospital workers were told to "double check" their paychecks to ensure they were paid correctly.

"But the way they do the pay system, it almost makes it impossible for a person to figure it out. And, for the most part, my paychecks looked accurate. So they just kept saying, you know, just double check, double check," she said.

But when she sent an email to an employee in the payroll department outlining concerns about discrepancies, the payroll employee "basically kind of wrote it off and said: 'Just be assured that your paychecks are correct,'" she said.

To this hospital worker, the payroll employee's comment contradicted what had been said earlier about double-checking pay amounts.

The worker said she was underpaid in her first two paychecks, then overpaid in subsequent February paychecks. This was confusing, because during the periods she was overpaid, she was told Kronos was back up and running.

According to Vilos: "As Kronos came back online, we then had to reconcile each pay period in chronological sequence during the timeframe that Kronos was not operational. The timeframe to complete the reconciliations crossed over an additional two pay periods. Upon completion of December's payroll reconciliation, we were then able to process and produce (IRS) W-2 tax forms for all employees.

"For many employees, as we estimated payroll based off a previous pay period, the pay, deductions and taxes were a direct reflection of the baseline pay period. In instances where we estimated an increase or bonus payment, the IRS standard tax rate of 22% was applied. In a week's time, after all reconciliations were completed, all underpayments were made."


Employees said they were given several options to pay back the money: pay it in a lump sum with check or cash; have the amount taken out of one paycheck; have it taken out over five paychecks; or cash out up to 160 hours of paid time off, and be unable to cash out any more this year.

Vilos said Thursday that "Employees who were overpaid had options to repay directly or through payroll deduction, either over a single pay period or over multiple pay periods, entirely their choice. For employees with hardship or unique challenges, we evaluated each one individually and provided additional options to better meet their unique circumstances."

One employee said she could tell she was being overpaid, so she set the money aside. She'd taken extra shifts in the weeks leading up to the Kronos outage during a spike in COVID-19 hospitalizations. This employee said it was her understanding that at least some of the paychecks during the Kronos outage were based a previous paycheck, meaning her pay during the outage was higher than normal.

She decided to pay the amount back all at once.

"When you have to write a check for (thousands of dollars), even though you know that it was overpayment money, it still kind of takes your breath away," the employee said.

Another said that, although she's been told she only owes a few hundred dollars, she's still trying to parse out the accuracy of her pay.

Employees said they were instructed to keep manual timesheets to give to their supervisors during the outage. It was unclear whether these timesheets were used to calculate employee pay, as employees also said they were told their pay over the next five cycles was based on the amount in their Dec. 10 paycheck.

Vilos said CRMC "used a recent, previous pay period as the baseline for the five pay periods that Kronos was not fully operational, and estimates were made off of that baseline pay period."

Some of the employees said that the money they may owe isn't the main problem.

"The point is that they mishandled this situation," one employee said. "They didn't get the help that they desired or needed. (A payroll department employee) said that she made the choice, along with her supervisors, to not hire any extra employees or outside help to do payroll. So it was just two (payroll) employees for the 2,200 (total Cheyenne Regional) employees."

This employee said she's lost some of her confidence in management following this incident.

All the employees who spoke to the WTE said they were aware of situations where hourly hospital workers were drastically over- or underpaid.

One person said she and colleagues had been discussing the possibility of contacting a labor organization, though they weren't clear on exactly who to go to or where to start. She said they just wanted someone "impartial" to investigate how things were handled.

"This has been a difficult and challenging situation that we, and thousands of other Kronos clients, had to work through," Vilos wrote. "It has been difficult on our payroll, accounting and HR staff, as well as every single employee. We regret any inconvenience or frustration this has caused. Now we are moving forward as our system has been restored, historical accuracy adjudicated and normal payroll functionality resumed."

A different perspective

After the WTE contacted Cheyenne Regional with specific questions regarding these employee complaints, a hospital spokesperson said she had reached out to department managers. The spokesperson said she believed there were "many employees who may have a different point of view" than those who said they'd had negative experiences.

One additional employee then contacted the WTE. She also asked to remain anonymous.

This hospital worker, who is also hourly, said the payroll disruption didn't have much of an effect on her.

"I always know how many hours I work every day. So, for me, it wasn't a big deal," she said.

The employee said the collective feeling within her small department was one of empathy toward payroll employees, understanding that they had a daunting, complex task on their hands.

"So, I think for me personally and the people around me," she said, "it was just like, 'Oh, gosh, those poor people are going to be overwhelmed."

Hannah Black is the Wyoming Tribune Eagle's criminal justice reporter. She can be reached at or 307-633-3128. Follow her on Twitter at @hannahcblack.