Wheatley launches inquiry into JETS cyber breach

Describing a recent cyber breach at Jamaica Electronic Transfer Services Limited (JETS) as a matter of “national concern”, Technology Minister Dr Andrew Wheatley has launched a formal inquiry, requesting a detailed report from the Bank of Jamaica (BOJ) and the nation's primary electronic transfer network on the matter.

JETS, which operates the MultiLink network and the Automated Clearing House (ACH), disclosed the incident on October 22, indicating that the breach may have exposed historical debit card numbers and customer names linked to ACH transactions.

It stated that the MultiLink and ACH payment networks were not affected and remain fully operational, allowing customers to continue using their debit cards and making ACH payments as normal.

In a release on Monday afternoon, Wheatley said the Government views the matter seriously, given the critical infrastructure nature of these systems and the payment card and customer data in JETS’ custody.

“Jamaicans rely on these networks every day to get paid, pay their bills and buy what they need. When an operator of systems this important experiences a breach, the Government and the public are entitled to a full account of what happened, who was affected and what is being done to ensure it does not happen again,” Wheatley said.

The minister has requested that JETS, with the support of the BOJ in the exercise of its oversight of the national payment system, submit a written report no later than October 31.

He has asked that the report address the nature and cause of the breach, including how access was gained, a full chronology of events from the earliest evidence of attacker activity, and the measures taken to detect, respond to and mitigate the breach.

The minister also wants to know the data and the number of customers and cards affected, whether any ransom or other demand was received, the actions taken in response, and the authorities and parties to whom the breach has been reported.

Further, he wants to know what steps were taken to protect affected customers, the remediation measures and lessons learned, including the findings of the independent forensic investigation, and the technical threat information to be shared with the Cyber Incident Response Team Division (CIRT) so that other institutions can protect themselves.

In disclosing the cyber breach, JETS admitted that hackers may have had access to historical debit card numbers and ACH customer names, but said Jamaica’s core payment networks were not breached.

The company pointed out then that the hackers could not access personal identification numbers (PINs), card verification values (CVVs) and expiry dates, as those are never stored.

Pending the full report, the minister has requested a preliminary briefing within 72 hours to himself, the CIRT Division, the Office of the Information Commissioner and the Major Organised Crime and Anti-Corruption Agency (MOCA).

He has also asked JETS to designate a senior point of contact, give immediate notice of any material development, and preserve all evidence relating to the incident.

“This request is not about assigning blame. JETS acted promptly to contain the incident and to inform the public, and that deserves recognition,” the minister said.

“But no single institution can manage the consequences of an attack on critical infrastructure alone. The lessons from this incident must be understood and shared, and they will inform the initial work of the National Cybersecurity Coordination and Assurance Council in strengthening the protection of Jamaica’s critical information infrastructure,” he added.

Follow The Gleaner on X, formerly Twitter, and Instagram @JamaicaGleaner and on Facebook @GleanerJamaica. Send us a message on WhatsApp at 1-876-499-0169 or email us at onlinefeedback@gleanerjm.com or editors@gleanerjm.com.