SD Worx shut down UK and Ireland payroll systems after cyberattack

SD Worx, the Belgian payroll and HR services group, shut down the IT systems supporting its United Kingdom and Ireland operations in April 2023 after detecting an intrusion.

The company said its security team discovered malicious activity in its hosted data centre overnight and took immediate action, preventively isolating all systems and servers. BleepingComputer reported that the activity was detected on the night before 10 April 2023. Customers in the affected region lost access to the customer portal and to payroll and HR services.

Portals serving other European countries continued to operate. Silicon Republic reported that customers of Intelligo, an Irish payroll business within the group, were also unaffected because its systems ran separately from SD Worx infrastructure.

SD Worx said the incident was not a ransomware attack and that there was no evidence at the time to assume any data had been compromised or lost. The company said it applies stringent organisational and technical security measures, that it was continuing to investigate, and that it would keep customers updated as it restored access.

SD Worx handles payroll for more than 82,000 companies and around 5.2 million employees across Europe. The company did not disclose how the intruders gained access, no group publicly claimed responsibility, and as of the reporting date it had given no further detail on the types of data involved.