Simpson v. UKG Inc

CourtDistrict Court, D. Massachusetts
DecidedJune 4, 2025
Docket1:22-cv-10947
StatusUnknown

This text of Simpson v. UKG Inc (Simpson v. UKG Inc) is published on Counsel Stack Legal Research, covering District Court, D. Massachusetts primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Simpson v. UKG Inc, (D. Mass. 2025).

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

* KIRSTEN MAXFIELD and CASEY * SIMPSON, on behalf of themselves and all * others similarly situated, * * Plaintiffs, * * Civil Action No. 22-cv-10947-ADB v. * * * UKG Inc., * * Defendant. * *

MEMORANDUM AND ORDER

BURROUGHS, D.J.

Plaintiffs Kirsten Maxfield and Casey Simpson (collectively, “Plaintiffs”), on behalf of themselves and all others similarly situated, assert several claims against Defendant UKG, Inc. (“UKG” or “Defendant”) seeking to recover lost wages allegedly resulting from a criminal ransomware attack that occurred in December 2021. [ECF No. 40 (“Amended Complaint” or “Am. Compl.”)]. Before the Court is Defendant’s motion to dismiss all claims. [ECF No. 44]. For the foregoing reasons, the motion is GRANTED in part and DENIED in part. I. BACKGROUND The following facts are taken from the Amended Complaint, the factual allegations of which are assumed to be true when considering a motion to dismiss. See Ruivo v. Wells Fargo Bank, N.A., 766 F.3d 87, 90 (1st Cir. 2014). As it may on a motion to dismiss, the Court has also considered “documents incorporated by reference in [the complaint], matters of public record, and other matters susceptible to judicial notice.” Giragosian v. Ryan, 547 F.3d 59, 65 (1st Cir. 2008) (quoting In re Colonial Mortg. Bankers Corp., 324 F.3d 12, 20 (1st Cir. 2003)). A. Factual Background UKG is a workforce management software company that provides companies nationwide

and internationally with human resource services, including timekeeping and payroll services. [Am. Compl. ¶ 20]. Among the many products and services it offers, as relevant here, UKG provides software known as the “Kronos Private Cloud,” which is a timekeeping and payroll service through which direct employers maintain employees’ personal information and time- keeping records and manage employee payroll. [Id. ¶¶ 20, 23]. UKG provides timekeeping and payroll services to a broad range of clients, including Plaintiffs’ direct employers, with whom UKG entered into payroll service agreements to operate and provide Kronos Private Cloud. [Id. ¶ 23]. UKG’s website indicates that its services, among other things, allow its customers to ensure accurate, on-time payments and to quickly generate payroll documents, such as paychecks and direct deposit files. [Id. ¶ 24].

On or around December 11, 2021, UKG suffered a ransomware attack and data breach on the Kronos Private Cloud (the “Kronos Outage”), which not only exposed millions of workers’ personal information to cybercriminals but also interrupted timekeeping and payroll systems for employers, resulting in workers not being paid, being paid late, or being paid incorrectly. [Am. Compl. ¶¶ 30–32]. On December 13, 2021, UKG posted an announcement regarding the Kronos Outage on its website, in which it confirmed that a ransomware attack had occurred and that the Kronos Private Cloud solutions were offline. [Id. ¶ 31]. UKG’s systems remained disabled for months after the Kronos Outage. [Id. ¶¶ 32–35].

2 On November 22, 2023, the United States District Court for the Northern District of California granted final approval of a class action settlement that released and resolved—on behalf of a nationwide class of employees of UKG’s customers—all claims against UKG relating to the Kronos Outage, with the sole exception of claims seeking wages (the “UKG Settlement”).

In re UKG Inc. Cybersecurity Litigation, No. 22-cv-00346, ECF No. 81 (N.D. Cal., Nov. 22, 2023). Specifically, the UKG Settlement released: Any and all claims, demands, actions, and causes of action that each and every Settlement Class Member has, had, or may ever have, known or unknown, suspected or unsuspected, fixed or contingent, accrued or unaccrued, arising out of or in any way related to the December 2021 KPC Cyberattack and the resulting interruption of Released Parties’ products and services, including all claims or causes of action stemming from statutory, contractual or common law rights under which the Settlement Class Members could seek to recover for any impact of the December 2021 KPC Cyberattack based on the allegations in the operative complaint, and all claims or causes of action that were or could have been brought in the Action based on the same factual predicate, whether or not those claims, demands, actions, or causes of action have been pleaded or otherwise asserted, including any and all damages, losses, or consequences thereof. Released Claims expressly do not include any claims, demands, actions, and causes of action (whether statutory, contractual, or common law) for wages of any kind brought against Released Parties relating to the December 2021 KPC Cyberattack or the resulting interruption of KPC applications.

In re UKG Inc., No. 22-cv-00346, ECF No. 68-2 (N.D. Cal., April 28, 2023) (emphasis added). It further stated: Defendant denies that Released Parties have any legal obligation for claims, demands, actions, or causes of action for wages of any kind relating to the December 2021 KPC Cyberattack or the resulting interruption of KPC applications. Plaintiffs recognize the novelty and uncertainty of such claims. The Parties nevertheless agree that Released Claims expressly do not include any claims, demands, actions, and causes of action (whether statutory, contractual, or common law) for wages of any kind brought against Released Parties relating to the December 2021 KPC Cyberattack or the resulting interruption of KPC applications.

Id. 3 Plaintiffs are hourly employees who did not receive the full amount of their wages in a timely fashion because their direct employers (Heywood Healthcare, Inc. and MaineHealth), who used Kronos Private Cloud, were unable to process payroll during the Kronos Outage. [Am. Compl. ¶¶ 1, 9–10, 12, 26–27]. Specifically, Plaintiffs allege that

they and “others similarly situated are employees who were not exempt from overtime under federal and state law, were not paid owed minimum wages for all hours worked, and/or at the proper overtime premium for all overtime hours worked and/or for all regular hours worked during and after the Kronos Outage.” [Id. ¶ 4]; see also [id. ¶¶ 6–7, 11 (similar)]. B. Procedural History Simpson filed her initial complaint in this action on June 16, 2022 against UKG and Kronos, Inc. [ECF No. 1]. Defendants moved to dismiss the complaint on October 19, 2022, [ECF No. 11], Plaintiff opposed on December 12, 2022, [ECF No. 21], and Defendants filed a reply in support of their motion on January 12, 2023, [ECF No. 26]. On April 13, 2023,

Defendants filed a notice of the UKG Settlement, [ECF No. 28], and the Court denied their motion to dismiss as moot in light of that settlement a few days later, [ECF No. 29]. On July 5, 2024, following approval of the UKG Settlement, Simpson moved for leave to amend her complaint to add Maxfield as a named plaintiff and to amend the asserted claims to assert only wage claims. [ECF Nos. 36, 37]. The Court granted Plaintiffs’ request, and the operative Amended Complaint was filed on July 17, 2024, naming only UKG as a defendant and seeking recovery of the wages that Plaintiffs are allegedly owed by their employers. [Am. Compl.].

4 II. STANDARD OF REVIEW On a motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6), the Court must accept as true all well-pleaded facts, analyze them in the light most favorable to the plaintiff, and draw all reasonable inferences from those facts in favor of the plaintiff. United

States ex rel. Hutcheson v.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Banco Santander De Puerto Rico v. Lopez-Stubbe
324 F.3d 12 (First Circuit, 2003)
Gagliardi v. Sullivan
513 F.3d 301 (First Circuit, 2008)
Giragosian v. Ryan
547 F.3d 59 (First Circuit, 2008)
Haley v. City of Boston
657 F.3d 39 (First Circuit, 2011)
Arthur D. Little International, Inc. v. Dooyang Corp.
928 F. Supp. 1189 (D. Massachusetts, 1996)
Spinner v. Nutt
631 N.E.2d 542 (Massachusetts Supreme Judicial Court, 1994)
FMR Corp. v. Boston Edison Co.
613 N.E.2d 902 (Massachusetts Supreme Judicial Court, 1993)
Strategic Energy, LLC v. Western Massachusetts Electric Co.
529 F. Supp. 2d 226 (D. Massachusetts, 2008)
Rymes Heating Oils, Inc. v. Springfield Terminal Railway, Inc.
265 F. Supp. 2d 147 (D. Massachusetts, 2003)
Wyman v. Ayer Properties, LLC
11 N.E.3d 1074 (Massachusetts Supreme Judicial Court, 2014)
Ruivo v. Wells Fargo Bank, N.A.
766 F.3d 87 (First Circuit, 2014)
Goonewardene v. ADP, LLC
434 P.3d 124 (California Supreme Court, 2019)

Cite This Page — Counsel Stack

Bluebook (online)
Simpson v. UKG Inc, Counsel Stack Legal Research, https://law.counselstack.com/opinion/simpson-v-ukg-inc-mad-2025.