Cyber Incident Victim: Jamaica National Group
Date:
Mar 2020
Location:
Jamaica
Summary
Jamaica National Group experienced a ransomware attack prompting an investigation by law enforcement agencies including the Major Organised Crime and Anti-Corruption Agency. The organization's IT and cybersecurity teams swiftly contained the malware's effects and worked to trace the attack's origin. Security authorities collaborated to assess the incident while the group focused on mitigating operational disruptions caused by the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 14, 2020, the Jamaica National Group experienced a ransomware attack targeting its systems. The organization detected the intrusion and activated its Information Technology and Cybersecurity teams to implement containment measures. These teams worked to limit the malware's spread across the network while simultaneously initiating forensic processes to trace the attack's origin. The incident prompted immediate engagement with Jamaican law enforcement authorities, including the Jamaica Constabulary Force’s Major Organised Crime and Anti-Corruption Agency (MOCA), which launched a formal investigation alongside other unspecified security agencies. No technical details regarding the ransomware variant, initial attack vector, or specific compromised systems were disclosed publicly by the organization or investigators following the breach discovery.

The Jamaica National Group confirmed the criminal investigation remained active but did not release information about operational disruptions, data compromise, financial losses, or whether ransom demands were issued by the attackers. Internal cybersecurity personnel maintained focus on mitigating the attack's effects throughout the response period. No customer advisories regarding potential data exposure or service interruptions were referenced in available reports. The organization's public communications emphasized collaboration with law enforcement but omitted specifics about remediation timelines, recovery processes, or long-term impacts on business operations. Law enforcement agencies did not disclose whether suspects were identified or if attribution efforts yielded conclusive results during the initial investigative phase.
