Updates on Cyber Incident 

The incident took place between October 29, 2024 and October 31st, 2024 

The incident was discovered on October 31, 2024 

The Data Protection Commissioner was immediately notified. Within 24 hours, an incident response team was mobilised to assess and contain the incident. The first public statement was issued on November 12, 2024. 

Since the first public statement, the Barbados Statistical Service (BSS) and Ministry of Industry, Innovation, Science and Technology (MIST) have updated the public at regular intervals. 

Resources have been mobilised from across the Government. The incident response team, has been supported by BSS and MIST. The Office of the Prime Minister has dedicated significant resources as well.

When the incident was discovered, all systems were immediately taken offline. Since then, the incident response team has been working tirelessly to restore data from secure backups. 

Investigations show that threat actors gained access through a compromised user account. 

BSS continuously invests in building our cyber capacity. We have appropriate tools and technology in place to protect against attacks. But, as we know that there are individuals and groups who work to infiltrate these systems, we continue to strengthen our safeguards. 

The data involved includes employee HR records and information captured for research purposes by the BSS.

We have set up this web page that people can access at any time to get updates, and information on how to stay safe online. You can also find this information on our social media pages on Facebook and Instagram

We have already contained the incident. That means we have strengthened internal measures against any further damage. But we continue to work on identifying and recovering affected data. 

• • Contact the business or entity where someone pretending to be you has committed fraud. 

• • Explain that your identity has been stolen 

• • Close new accounts in your name 

• • Ask the business to officially confirm that the activity was not done by you 

• • Contact the government entity that issued the compromised ID or holds the stolen information. 

• • • Electoral and Boundaries Commission
    • Registration Department
    • Immigration Department
    • National Insurance and Social Security Service
    • Barbados Revenue Authority

• • Ask them to cancel or reissue the ID 

• • Follow the instructions set out by the entity for this 

• • Note that this might take some time, as agencies need to check a lot of information again. Be patient. 

• • Destroy or surrender any copies of old IDs  

• • Update bank and other accounts with the new ID information 

• • Before you receive the new details, notify your bank, workplace, or school that your identity has been stolen 

• • Notify credit bureaus that fraudsters might be using your details to carry out transactions  

• • Ask them to put a fraud alert on your credit report 

• • Cancel or change the password or authentication method for all possibly affected online services 

• • Follow advice for authentication and securing accounts

• • For utilities such as water or electricity, ask for your account to be investigated or closed 

• • • Barbados Water Authority

• • • Barbados Light and Power

• •  Report any indication that your identity has been stolen to the police  
  • Suspicious incidents include unverified credit card charges, notification of new loan or credit card applications, missing bills or letters 

• • If impersonators use your identity to commit crimes, ask for the imposter’s real name (rather than yours) to appear in police and court records.  

• • Avoid sharing ID information with others, especially online (Trident ID, passport, NIS number, etc.)  

• • It doesn’t matter who it is. Your ID information should be shared only when strictly necessary 

• • Monitor all letters, emails, text messages or phone calls you receive 

• • Fraudulent email addresses can look ‘official’ 

• • Instead of replying to messages directly, or calling the number listed in the message, contact the business using their official contact information to verify the message  

• • If you get a text to pay your electricity bill now or your service will be disconnected, do not answer the text. Don’t call the number in the text. Don’t click on any link in the text. Call or visit Barbados Light & Power to confirm.  

• • Be suspicious of contact from numbers you don’t recognise, but the people claim to be family members. Always call to check 

• • Monitor your credit closely 

• • Check any charges you do not recognise or recall 

• • Monitor your financial transactions closely, especially those done online or with credit cards 

• • Monitor utility bills for unusual charges  

• • Follow advice for preventing identity theft https://www.getsafeonline.bb/personal/articles/safeguarding-identity/  

• • Don’t use the same password for everything  

• • Use strong password generators or three random words to create a strong password 

• • Change passwords frequently  

• • Consider using a secure password manager to store them 

• • Use multi factor authentication (MFA) where possible 

• • This is where you have to sign in two different sources like your phone and your computer to gain access to your accounts 

• • Use a secure internet connection 

• • If you suspect your device is being attacked, disconnect it from the internet immediately 

• • Get educated 

• • If your school or workplace has cybersecurity training, take it seriously 

• • Threat actors usually impose use time deadlines or emotional manipulation to force us to act quickly 

• • Training prepares us to respond appropriately in a crisis