Money worries

THERE were jitters in Jamaica’s financial sector on Friday as the operators of the MultiLink debit card and Automated Clearing House (ACH) networks confirmed that sections of its system had been the subject of a cyberattack. In an early morning release Jamaica Electronic Transfer Services (JETS) said the cyberattack, which had been circulating as a rumour since Thursday, involved a limited part of its internal administrative systems, but the MultiLink and ACH networks were not affected and both remained fully operational. “The JETS Cyber Monitoring Team detected suspicious activity within a limited portion of the company’s domain and immediately shut down the administrative system, isolated and launched a full forensic investigation in coordination with specialist cybersecurity consultants. “While payment networks were not affected, there were reports with payment transactions accessed by the hackers that contain information that may have exposed the names of some customers who received transfers via ACH, as well as some card numbers from historical administrative data files on the debit network,” said JETS. “It is important to note, however, that personal identification numbers (PINs), card verification values (CVV), and expiry dates are never stored and would not have been impacted,” added JETS as it sought to allay fears of people in the financial sector and members of the public. According to JETS, both it and its member institutions have employed necessary and vital steps to protect the integrity of the payment systems and customer information. “Customers of member institutions are, however, encouraged to observe standard digital-safety practices and contact their individual financial institutions should they receive unsolicited communication about their card or account,” said JETS. By mid-afternoon Friday, the Bank of Jamaica (BOJ) also moved to quiet fears in the financial sector with a media release stating that it has been engaged with JETS, its member financial institutions, and the relevant national authorities since being informed of the incident. According to the BOJ, with JETS confirming that the MultiLink and ACH networks were not affected and remain fully operational, customers can continue to use their debit cards and make ACH payments as usual. “The bank’s first priority is the protection of Jamaican consumers and the integrity of our payments system. The bank is working closely with JETS, the member financial institutions, and our national partners to support the response to this incident and to protect customers. “We support JETS’ decision to inform the public. Transparency and coordinated action are the right response, and the bank will provide further updates as appropriate,” said the BOJ. It added that as a precaution, and consistent with the guidance issued by JETS, members of the public are encouraged to: • review their accounts or credit card transactions via their respective online platforms regularly, also closely monitor bank alerts and report any unfamiliar transaction to their financial institution promptly; • be cautious of unsolicited calls, text messages, e-mail or social media messages about their card or account, including any that claim to be from their bank, JETS or Bank of Jamaica, as these may be attempts at fraud; • never share a PIN, CVV, one-time password, or online banking login with anyone. Legitimate institutions will not request these details. • contact their financial institution directly, using the number on the back of their card or on the institution’s official website if they have any concerns. “Bank of Jamaica, in its oversight of the national payments system, will continue to monitor developments closely and will take such action as is necessary to safeguard the safety and efficiency of the system. The payments system continues to operate normally,” the release added. In the meantime, Opposition spokesman on science, technology, and digital transformation Christopher Brown expressed concern over the issue, which he said may have exposed personal and financial information belonging to customers. While noting JETS’ assurance that the MultiLink and ACH payment networks were not compromised, Brown said the potential exposure of customer names and debit card information raises legitimate concerns about data protection, cybersecurity safeguards, and the security of Jamaica’s critical financial infrastructure. He pointed out that this incident comes against the background of the Government’s own disclosure that Jamaica recorded more than 49 million attempted cyberattacks in 2025 and another 5.4 million in the first quarter of 2026. “We have heard repeated announcements about a National Cybersecurity Strategy and the establishment of a Cybersecurity Council. While these initiatives are important, we remain deeply concerned that the comprehensive legislative framework necessary to strengthen cybersecurity standards, institutional accountability, and the protection of critical digital infrastructure remains absent,” said Brown. He underscored that, despite the escalating threats, Jamaica has still not enacted the proposed Cybersecurity Act. “Strategies, councils and policy announcements, however well-intentioned, cannot substitute for a robust and enforceable legislative framework. The Government must urgently accelerate the enactment of the Cybersecurity Act and provide a clear timetable for its passage,” added Brown. He also called on JETS and the regulatory authorities to ensure a thorough investigation, establish the full extent of any exposure of personal and financial information, and provide timely notification and appropriate protection to affected customers.