Jamaica's cyber threat landscape: why SMEs are targets

When cyberattacks make the news in Jamaica, the victims are usually large institutions: a regulator, an investment firm, a state agency. It is easy for a small business owner to read those stories and conclude that criminals are not interested in a 15-person company in Spanish Town or May Pen. That conclusion is wrong, and it is worth understanding why.

What has happened in Jamaica

A short list of publicly reported incidents shows the range of methods attackers use locally:

• JamCOVID data exposure (2021). TechCrunch reported in February 2021 that a cloud storage server used for the government's JamCOVID19 website, built by contractor Amber Group, had been left publicly accessible, exposing immigration documents and COVID-19 test results. Further lapses were reported in the weeks after. No sophisticated hacking was needed; the data was simply misconfigured.
• Mayberry Investments (2023). The Jamaica Gleaner reported in June 2023 that Mayberry confirmed it had been the victim of a ransomware attack. The Play ransomware group claimed responsibility and published data online; the company said no ransom was paid and that client accounts were not accessed.
• Financial Services Commission (2023). In September 2023 the FSC, which regulates the insurance, pensions and securities industries, confirmed it had suffered a ransomware attack. The Jamaica Observer reported that some of its files were later published by the BlackSuit group. The FSC said it did not pay a ransom.
• Petrojam (2023). The Jamaica Gleaner reported in December 2023 that the state-owned refinery confirmed a cyber incident.
• Bureau of Standards Jamaica (2024). The Jamaica Gleaner reported in May 2024 that the BSJ had been hit by ransomware in February, reportedly stemming from a phishing attack that compromised staff credentials. The agency said no ransom was paid, but it had spent US$231,900 on recovering and securing its systems.
• WhatsApp account takeovers (2026). In June 2026 the Jamaica Gleaner reported on people whose WhatsApp accounts had been taken over and used to ask their contacts for money, with the scam spreading from one trusted account to the next.

What the authorities have said

Jamaica has had a National Cyber Security Strategy since 2015, and the Jamaica Cyber Incident Response Team (JaCIRT) coordinates the response to incidents. Speaking at a Jamaica Information Service Think Tank in October 2023, JaCIRT head Lieutenant Colonel Godphey Sterling said overseas ransomware gangs continue to target organizations in Jamaica, that more than 10 such gangs had been identified, and that they operate like structured criminal organizations with leaders and divided roles. In a 2022 Jamaica Gleaner report, he described Jamaica as largely a soft target because of the maturity level of its cyber infrastructure.

Why SMEs are targets

Most attacks are automated

Criminal groups scan the entire internet for weaknesses: remote desktop exposed to the internet, unpatched VPN appliances, CCTV recorders with default passwords, email accounts with reused passwords. The scanning software does not know or care how big your business is. If your system is vulnerable, it ends up on a list.

Email and messaging are the front door

The BSJ attack reportedly began with phishing. Small businesses receive the same fake invoices, fake delivery notices and fake login pages as large ones, but rarely have filtering, training or a second person checking payment requests. Business email compromise, where a criminal takes over or imitates an email account to redirect a payment, works especially well where one person handles both email and the bank login. In Jamaica, much business also runs over WhatsApp, which makes account takeover a direct threat to sales.

Fewer people, fewer defenses

Many SMEs have no dedicated IT staff. Passwords are shared, multi-factor authentication is off, backups are on a drive plugged into the same computer, and nobody reviews logs. Each of these makes an attack easier to carry out and harder to recover from.

You can be the route to someone bigger

The JamCOVID exposure involved a contractor, not the government's own systems. Small firms that provide IT, accounting, payroll, marketing or logistics services to larger organizations often hold their data or have access to their systems. Attackers know that a supplier with weak security can be a way into a well-defended client, and larger clients are increasingly asking suppliers to prove their security before signing contracts.

Downtime hurts more

A large organization can usually survive weeks of disruption. A small business with a few weeks of cash on hand may not. Ransomware gangs count on that pressure to get paid, and a business without working backups has very few good options.

Personal data now carries legal duties

Under the Data Protection Act, a breach that may affect personal data must be reported to the Information Commissioner within 72 hours. Customer lists, staff files and CCTV footage all count. Our Data Protection Act compliance checklist explains what that involves.

The threats Jamaican SMEs should plan for

• Phishing emails and fake login pages that steal passwords.
• Payment diversion: fake or altered invoices and "new bank details" requests.
• Ransomware that encrypts files and threatens to publish stolen data.
• Takeover of WhatsApp, email and social media accounts.
• Exposed devices, such as CCTV recorders, routers and remote desktop, with weak or default passwords.
• Lost or stolen laptops and phones holding unencrypted data.
• Misconfigured cloud storage and file sharing links open to anyone.

Practical defenses that fit an SME budget

1. Turn on multi-factor authentication for email, banking, cloud services and WhatsApp (two-step verification). This blocks most password-based attacks.
2. Keep backups that ransomware cannot reach. Keep at least one copy offline or in a separate account, and test restoring from it.
3. Patch and replace. Keep systems updated, and retire computers and devices that no longer receive security updates.
4. Close what does not need to be open. Do not expose remote desktop or camera recorders directly to the internet; use a firewall and a VPN instead.
5. Verify payments by phone. Any request to change bank details or make an urgent payment should be confirmed using a number you already have.
6. Train your staff. Short, regular sessions and phishing simulations are far more effective than a single annual talk.
7. Limit access. Give staff only the access they need, and keep admin accounts separate from everyday ones.
8. Write a one-page incident plan with who to call, what to disconnect and how to reach your IT provider, bank and the authorities.

If you are attacked

Disconnect affected computers from the network, but do not wipe them; you may need the evidence. Change passwords from a clean device, call your IT or security provider, and tell your bank immediately if payments may be involved. JaCIRT has advised victims of ransomware and social engineering to report incidents to JaCIRT, the Major Organised Crime and Anti-Corruption Agency (MOCA) or the Jamaica Constabulary Force. If personal data may be affected, remember the 72-hour reporting duty to the Information Commissioner.

None of these defenses requires a large IT department. If you want help putting them in place, our cybersecurity services start with a gap analysis that shows where you are exposed, and our security awareness training gives your staff the habits that stop most attacks at the inbox.