Direct Deposit Was Stolen

Location: Massachusetts USA

The company I work for uses Toast for payroll. On September 7th I got a notification that I had set up split direct deposit, 100% of the deposit going to an unknown bank account. I immediately changed my password and deleted that bank account. On September 9th split direct deposit was set up again, but I missed the notification email because my email was being absolutely flooded with random stuff. On September 11th I did not receive my paycheck and that’s when I noticed that it went entirely to the person who hacked the account. I went back and checked and every email that I have from Toast is from the same email address, I did not click on any phishing links. I immediately notified management and they contacted Toast to attempt to pull back the funds. They say that I’ll know by September 21st at the latest if that is even possible, if the money isn’t still in the hackers account then they can’t get it back. They have told me that won’t reissue the check, and if the funds don’t come back, to file a police report. (We all know that those funds aren’t going to be coming back). Does my employer legally still have to give me that money? Or am I just out of luck? That’s two weeks of full time work that never even touched my bank account. Just the waiting for the money is hard enough as I’m very much paycheck to paycheck. If they do legally have to pay me, and refuse, what is my next step? And if they don’t, is there anything else I can do to get the money back?