Tech contractors fume over payday outage at Giant Pay after it sniffs 'suspicious activity'

Technical difficulties, please stand by

Updated Giant Pay – an umbrella company used by contractors across the UK – has confirmed "suspicious activity" on its platform is behind a days-long ongoing outage that has left folk fretting about whether they'll get paid this month.

In an update on its website today, the firm said: "Upon detection of suspicious activity on our network on 22nd September 2021, we immediately assembled a response team including IT data experts and specialist lawyers, and we are currently working with the highest priority to resolve this issue.

"As part of the investigation and as a measure of caution, we have proactively taken our systems offline and suspended all services temporarily." It also confirmed it had contacted regulatory authorities and assured contractors they would get paid.

"As an interim measure, and to ensure that payment is made to your account on 24 September, we will pay you the same amount that was paid to you last week. This will be paid via Faster Pay and will be in your account by the end of the day. As soon as possible, we will confirm that your payroll is back to normal. We appreciate that this is not ideal, but we wanted to ensure that you receive a payment."

A number of employees – including tech contractors – have contacted The Register fuming at the lack of information from the company in recent days and its failure to respond to emails.

Giant Umbrella has been down "since Tuesday and are failing to pay contractors wages. No phone, no emails and they are failing to respond to webchats," said one, adding: "It’s lucky UK gov didn’t force most contractors to go inside IR35 and need umbrella services. How many contractors have been hit by this and what can they do to get paid?"

Another Reg reader added that the umbrella company had clearly had "some kind of major outage this week which is affecting a lot of IT contract staff."

Giant Umbrella is a subsidiary of Giant Group PLC, and claims its "long-term clients – since 1992 and ongoing – include Page Group and Barclays Bank."

Until UK lunchtime today, a notice on its portal simply stated: "Portal Downtime. We are experiencing technical difficulties and are working to get them resolved as quickly as possible. We apologise for any inconvenience caused."

Angry contractors had taken to Twitter.

A post by someone on Giant Umbrella's Trustpilot page this morning said they had contacted the CFO via LinkedIn, who claimed they're "working to get everyone paid today and will be getting communications out shortly."

However, none of this was confirmed as no one from the company had replied to requests for information. But what little people knew has not gone down well with contractors who rely on Giant Pay for their payroll.

Another said: "Extremely concerned. Their portal has been down all week with no communication. The contact number does not work and I have not been paid! I have been forced to use [an] umbrella service because [of] IR35 and this is a direct consequence. Just not good enough."

A third reported that the organisation where they work has more than a hundred contractors, lamenting: "We haven't been paid, with no prior notification..."

With tempers boiling over, this tweet posted this morning summed up the frustration felt by many:

Despite repeated attempts to contact the company, no one from Giant Pay was available for comment at the time of writing. ®

Updated to add on 27 September 2021:

We have asked a few of Giant Pay clients for comment. Recruitment outfit PageGroup said of the outage:

"We are aware of an issue with our third party payroll supplier and are working with them to investigate what, if any, PageGroup data is involved.

"We have taken action directly to ensure payments have been made today, and emails were sent out to those affected this morning regarding next steps.

"We will continue to work with Giant Pay to investigate and will provide updates with further information as soon as we can."

Other stories you might like

  • Tencent admits to poisoned QR code attack on QQ chat platform
    Could it be Beijing was right about games being bad for China?

    Chinese web giant Tencent has admitted to a significant account hijack attack on its messaging and social media platform.

    In a post to rival social media platform Sina Weibo – a rough analog of Twitter – Tencent apologized for the incident.

    The problem manifested on Sunday night and saw an unnamed number of QQ users complain their credentials no longer allowed them access to their accounts. Tencent has characterized that issue as representing "stolen" accounts.

    Continue reading
  • Carnival Cruises torpedoed by US states, agrees to pay $6m after waves of cyberattacks
    Now those are some phishing boats

    Carnival Cruise Lines will cough up more than $6 million to end two separate lawsuits filed by 46 states in the US after sensitive, personal information on customers and employees was accessed in a string of cyberattacks.

    A couple of years ago, as the coronavirus pandemic was taking hold, the Miami-based biz revealed intruders had not only encrypted some of its data but also downloaded a collection of names and addresses; Social Security info, driver's license, and passport numbers; and health and payment information of thousands of people in almost every American state.

    It all started to go wrong more than a year prior, as the cruise line became aware of suspicious activity in May 2019. This apparently wasn't disclosed until 10 months later, in March 2020.

    Continue reading
  • India extends deadline for compliance with infosec logging rules by 90 days
    Helpfully announced extension on deadline day

    India's Ministry of Electronics and Information Technology (MeitY) and the local Computer Emergency Response Team (CERT-In) have extended the deadline for compliance with the Cyber Security Directions introduced on April 28, which were due to take effect yesterday.

    The Directions require verbose logging of users' activities on VPNs and clouds, reporting of infosec incidents within six hours of detection - even for trivial things like unusual port scanning - exclusive use of Indian network time protocol servers, and many other burdensome requirements. The Directions were purported to improve the security of local organisations, and to give CERT-In information it could use to assess threats to India. Yet the Directions allowed incident reports to be sent by fax – good ol' fax – to CERT-In, which offered no evidence it operates or would build infrastructure capable of ingesting or analyzing the millions of incident reports it would be sent by compliant organizations.

    The Directions were roundly criticized by tech lobby groups that pointed out requirements such as compelling clouds to store logs of customers' activities was futile, since clouds don't log what goes on inside resources rented by their customers. VPN providers quit India and moved their servers offshore, citing the impossibility of storing user logs when their entire business model rests on not logging user activities. VPN operators going offshore means India's government is therefore less able to influence such outfits.

    Continue reading
  • Hangouts hangs up: Google chat app shuts this year
    How many messaging services does this web giant need? It's gotta be over 9,000

    Google is winding down its messaging app Hangouts before it officially shuts in November, the web giant announced on Monday.

    Users of the mobile app will see a pop-up asking them to move their conversations onto Google Chat, which is yet another one of its online services. It can be accessed via Gmail as well as its own standalone application. Next month, conversations in the web version of Hangouts will be ported over to Chat in Gmail. 

    Continue reading

Biting the hand that feeds IT © 1998–2022