PrismHR, a company that sells technology used by other firms to help more than 80,000 small businesses manage payroll, benefits, and human resources, has suffered what appears to be an ongoing ransomware attack that is disrupting many of its services.
Hopkinton, Mass.-based PrismHR handles everything from payroll processing and human resources to health insurance and tax forms for hundreds of “professional employer organizations” (PEOs) that serve more than two million employees. The company processes more than $80 billion payroll payments annually on behalf of PEOs and their clients.
Countless small businesses turn to PEOs in part because they simplify compliance with various state payroll taxes, and because PEOs are the easiest way for small businesses to pool their resources and obtain more favorable health insurance rates for their employees.
PrismHR has not yet responded to requests for comment. But in a notice sent to its PEO partners, PrismHR said it detected suspicious activity within its networks on Feb. 28, and that it disabled access to its platform for all users in an effort to contain the security incident.
The company said the disruption has affected 200 PEO clients across the country, and that the most immediate concern is helping PEOs ensure their customers can process payrolls this week.
“The outage may extend throughout today and possibly later, with potential impact on payroll processing,” Prism explained in a template email it suggested PEO partners share with their customers. “We are committed to ensuring everyone receives their pay as timely and as accurately as possible. For this payroll period, we will use estimates from the last available payroll period. Once the software platform is back online, we will perform a reconciliation and correct any discrepancies as soon as possible.”
Jacob Cloran is co-founder of Decimal, a company that does accounting for small businesses, many of whom rely on PEOs affected by the PrismHR outage. Decimal itself uses a PEO that relies on PrismHR.
“We don’t have a good option to run our payroll this week, and the message we’ve received from our PEO doesn’t give me a lot of confidence we’ll be able to do that,” Cloran said.
Cloran said while there are other cloud-based companies that work with multiple PEOs, PrismHR is by far the largest.
“Prism is the only real option on the PEO software market,” he said. “Everyone I know who has tried any of the others ends up back at Prism. It’s the best of all bad available options.”
PrismHR did not specify what was responsible for the suspicious network activity, but their actions so far are straight out of the textbook recommendations for responding to a ransomware outbreak. A notice from the PEO working with some of Cloran’s clients stated that PrismHR was in the process of rebuilding its entire system from data backups in a new environment.
Also, the crooks behind ransomware attacks typically wait until the weekend to unleash their malware within victim organizations, knowing that most targets will be short-staffed or out of the office at this time. PrismHR said it detected the activity on Sunday.
Ransomware victims perhaps in the toughest spot include those providing cloud data hosting and software-as-service offerings, as these businesses are often unable to serve their customers while a ransomware infestation is active.
Ransomware renders any files it touches unreadable unless and until a victim pays for a digital key needed to unlock the encryption on them. Worse, it has become almost a best practice among ransomware criminal groups to steal as much data as possible from the victim organization prior to unleashing the ransom malware within a target environment.
Some of that data is often then published on dark web victim shaming sites in a bid to force the victim company into paying up. Some companies victimized by ransomware even face dual ransom demands: One for a digital key needed to unlock access to files, and a second payment in exchange for a promise not to publish all of the stolen data. Those that refuse to be extorted are told to expect that huge amounts of sensitive company data will be published online or sold on the dark web (or both).
PrismHR said in a statement to its PEO customers that while its investigation and response to the incident is ongoing, the company “is not aware of any sensitive data being breached or compromised.”
Given the volume and sensitive nature of the data PrismHR managed on behalf of PEO clients, it’s no doubt those clients and their customers are hoping that statement is accurate as well.
Those darn Russians! First the election, now these ransomware attacks…. what does a man need to do to get them to chill out?
Send them some weed?
Tell them to release Alexei Navalny from jail. I’m sure that will get them to chill out.
They should treat these types of attacks as physical attacks against our nation and tell these foreign nations that they are responsible for the actions of their people or else the US will defend itself, regardless of their borders and handle it ourselves. With our influence and money we dump into those nations (that is another issue), we should have substantial pull to make these host nations stop this, or reduce it substantially.
This on hits me right in the pocketbook unfortunately. If only I knew a whole team of Managed Services engineers with a vested interest that could help…
Coadvantage is an alternative . The system does not use prismHR .
dola@coadvantage.com
we can discuss employer tax credit too.
https://www.irs.gov/instructions/i5884
Wow… Classy Move
Wow – except CoAdvantage DOES use prism for almost all their clients. Ohhh and have been bought and sold by 4 private equity providers since 2012. Coad 360 is prism.
The cyber-criminals are like the current pandemic, they never seems to just go away.
“Submitted for your approval” ……
I’m sure this is totally unrelated: https://chatfortress.com/directory/company/iMeABZTR9jcqN7bwKAZD
Jacob Cloran is wrong, Prism is not the only option for PEO software. Worklio is another which perform much better, has more recent technology and treats their customers very well.
I agree 100% . Worklio is a great product and customer service is great
…fullstack academy uses workday – seems to be full featured…
I agree with Craig Ahlswede. PrismHR isn’t the only option. We are with a PEO that uses ThinkWare and we are very impressed with it.
We have seen Thinkware- the are far behind technology
Agreed
The comment that “Prism is the only real option on the PEO software market,” he said. “Everyone I know who has tried any of the others ends up back at Prism. It’s the best of all bad available options.”
This is totally untrue. PEO’s have left and so many have not come back to PrismHR. By far they are not the only game in town. I know of at least three other platforms which are at least equal in performance and much, much less expensive.
I am curious – did you try ours? Build on a new tech stack, modern UI and friendly features (a lot of them…)?
I did!! And my brother in laws company did. WE DID GO BACK!
If their systems aren’t up, it seems a good bet that data has been compromised.
We use PrismHR. We are experiencing the outage but we managed to run our payroll on time.
Don’t ask me how
We were able to do the same. Secure data to customers was supplied to aid in the creation of ACH and POSIPAY files.
Can somebody tell my:
Why can client computers access server networks and file shares with the backend data ?
IMHO a cryptolocker software could take down lots of files on fileserver shared by PCs. And if you get a domain controller taken over, the servers might be hit as well. But that would be real hacking, or a wormable exploit somebody did not care to patch.
At most companies, security is a second thought (if lucky!). The board doesn’t care about security until they get hit. Therefore, resources to tighten and enhance security are hard to come by.
To top it off, management has the mindset of get it done now, and neglecting security makes for faster completion. Security, done right, is hard and often inconvenient. Proper network segregation is hard and not everyone has the skills to do it.
Thanks a lot for sharing worth piece of content.
Prism is definitely not the only option-in fact, we found it not to be an option at all for us. We use Thinkware and could not be happier.
Even with almost no automation and little ability to handle self service payroll for clients?
I am so sorry that you are all going through this! We tried going to PRISM software but couldn’t get it to work for us. We ended up going with Worklio and are VERY pleased. Worklio had a webinar today to discuss their security protocols in detail for anyone concerned about what happened with PRISM. Worklio is ISO 27001 certified for security – which our IT gal says is extremely important! Also – they use separated instances and groups for each PEO company so if problems occur in one customers instance, the others remain safe! The data is also backed up regularly and stored in multiple locations. We have been using them for almost 2 years now and are very happy!!! If you have any questions on my experience with Worklio – feel free to give me a call at any time! The last thing our industry needs is bad publicity and this certainly is not going to help. 🙁 Again – thinking of all of you and here to help if I can.
If BleepingComputer were a college student, they’d be up on plagiarism charges now. Look how much they copped directly from Krebs here: https://www.bleepingcomputer.com/news/security/payroll-giant-prismhr-outage-likely-caused-by-ransomware-attack/
Paycor has alternate solutions to help with all your payroll and HR needs. Feel free to give me a call at 213-712-5920!!
We were on Prism but switched to Pro Software. Best decision we made. It’s one platform and very easy to use.
You know who could process payroll this week? Those of us using Pro Software’s PEO software.
How can you be a “Disgruntled Payroll Processor” while giving a sales pitch?
Tapping my toe, waiting for more information from PrismHR. Our HR function is at a standstill this week as a result of this outage and we’re in our busy season at my company. This is getting ridiculous and they aren’t being forthcoming with information at all.
Prism is up today and seems to be functioning normally.
just checked and got a 503. another day down the drain.
It was working earlier today but the employee side went down this afternoon. The employer side is still working for me.
Thanks to this article I can learn more. Expand my knowledge and abilities. Actually the article is very real.
Add this to the list of reasons a company may want to leave a PEO:
https://www.bizjournals.com/sanfrancisco/news/2018/07/01/why-transitioning-away-from-a-peo-might-make-sense.html