Popular sportswear company Puma was hit by a data breach following the ransomware attack that hit Kronos, one of the workforce management service providers in North America, in December 2021.
See also: NetWalker ransomware collaborator sentenced to 80 months in prison
The data breach notification filed with prosecutors' offices earlier this month says the attackers also stole personal information belonging to Puma employees and other organizations using the Kronos Private Cloud (KPC) cloud environment before encrypting the data.
Kronos describes KPC as secure storage, protected from attacks, using firewalls, multi-factor authentication, and encrypted transmissions.
It is used to host Workforce Central, Workforce TeleStaff, Enterprise Archive, TeleTime IP, Extensions for Healthcare (EHC) , and FMSI.
See also: Ransomware gangs are changing tactics and ransoms are increasing!
"Since the attack was discovered, Kronos has conducted a comprehensive review of the affected environment to determine whether any individual's personal information was subject to unauthorized access or acquisition," it said in letters to affected individuals on February 3.
Although the breach notification does not state how many Puma employees had their data stolen during the attack, information provided to the Maine Attorney General's Office reveals that the ransomware operators got their hands on data belonging to 6,632 people.
Puma said that documents stolen during the Kronos ransomware attack include Social Security Numbers.
See also: BlackCat Ransomware: Link to BlackMatter, DarkSide Gangs
Individuals affected by this data breach were also offered two years of free subscription to Experian IdentityWorks, which comes with credit monitoring, identity restoration, and identity theft insurance.
Puma is one of the world's leading sports brands with 14,300 employees worldwide and 5.23 billion euros in sales in 2020.
