BEND, Ore. (AP) — St. Charles Health System in Central Oregon accidentally overpaid thousands of employees a total of $2 million and is demanding employees pay that money back.

Employees were told Thursday of the total amounts allegedly owed, Oregon Public Broadcasting reported.

Scott Palmer of the Oregon Nurses Association said the amounts range from less than $100 to as much as $3,000. St. Charles leadership said in a written statement that the average amount owed is $780, and that many employees have already signed forms agreeing to repay the money.

More than 2,300 employees owe some money to St. Charles, a spokeswoman told The Bulletin.

The overpayment issues began in November when hackers launched a ransomware attack on Ultimate Kronos Group, a technology company that runs St. Charles’ payroll system. Many businesses across the U.S. that use the system were unable to access timecard data.

From late November until January, the hospital paid employees based on hours they reported during that time, a spokesperson said.

Palmer said the nurses association plans to issue a cease and desist letter to St. Charles demanding it halt the repayment process and saying it could be illegal. He said in one case, a nurse was notified about an amount allegedly owed with a sticky note.

“This is just yet another way in which nurses and frontline health care providers and staff are being burdened,” Palmer said, noting years of enduring the COVID-19 pandemic.

He said members of the nurses association have received little evidence that the hospital system overpaid employees.

“(St. Charles is) just asserting that this money is owed with no documented support, at least none that we can tell from our members,” he said.

St. Charles representatives declined requests form Oregon Public Broadcasting for an interview.

“While we recognize this is an inconvenience for our employees, we’ve communicated from the beginning that this is a step we’d eventually need to take,” spokesperson Lisa Goodman wrote in a statement.

She also wrote that St. Charles has been paying back employees whom the hospital underpaid as a result of the hack.