The Attack That Changed Everything

In July 2025, ransomware attackers struck Curaçao’s Tax and Customs Administration, crippling vehicle tax processing, telephone support, and customer-service operations for nearly two weeks. In the same wave of attacks, government systems in Aruba and Sint Maarten were compromised, disrupting parliamentary communications and justice-system operations across the Dutch Caribbean. Recovery required the deployment of specialist IT security teams from the Netherlands – a dependency that exposed just how thin the region’s indigenous cyber-defence capability actually is.

These were not isolated incidents. They were symptoms of a structural vulnerability that affects every Caribbean organisation, public and private. The World Economic Forum’s Global Cybersecurity Outlook 2026 reports that only 13 per cent of respondents in Latin America and the Caribbean are confident in their country’s preparedness to respond to a major cyberattack on critical infrastructure. Compare that to 84 per cent in the Middle East and North Africa. The Caribbean is, by this measure, the least cyber-confident region on Earth.

Meanwhile, the threat is accelerating. Ransomware activity in the Caribbean and Latin America has surged by 550 per cent in recent years, according to Mandiant’s threat-intelligence analysis. Credential theft has increased 160 per cent globally in 2025, with stolen credentials remaining undetected and active for an average of 94 days. The annual cost of cyberattacks in Latin America and the Caribbean is projected to exceed US$90 billion, with Caribbean businesses – particularly SMEs, government agencies, hospitals, and financial institutions – disproportionately targeted because they are perceived as soft targets with weak defences and limited incident-response capability.

Cybersecurity is no longer an IT issue. It is a board-level strategic risk that can destroy shareholder value, cripple operations, trigger regulatory penalties, and erode the customer trust that Caribbean businesses depend on. The board that delegates cybersecurity entirely to the IT department is the board that will be explaining a breach to regulators, customers, and the media.

Why the Caribbean Is Uniquely Vulnerable

 

The Infrastructure Gap

Caribbean organisations operate on technology infrastructure that was, in many cases, deployed a decade or more ago and has not been systematically updated. Legacy systems, unpatched software, end-of-life operating systems, and ageing network equipment create an attack surface that is vastly larger than it should be. The Curaçao tax-administration attack exploited precisely this kind of vulnerability: systems that were functional but not hardened against modern threats. When the cost of replacing legacy infrastructure competes with more visible operational priorities, cybersecurity investment loses – until the breach occurs.

The Talent Desert

The Caribbean faces a cybersecurity skills shortage that is severe even by global standards. The region’s educational institutions produce a small number of cybersecurity graduates each year, many of whom emigrate immediately to North America or Europe where salaries are three to five times higher. The result is that most Caribbean organisations cannot recruit or retain the specialised cybersecurity professionals they need. Security operations are frequently delegated to general IT staff who lack the training, tools, and time to perform effective threat detection and response.

The Regulatory Patchwork

Caribbean data-protection and cybersecurity regulation is evolving rapidly but unevenly. Jamaica’s Data Protection Act is now in active enforcement. Barbados has enacted its own Data Protection Act. Trinidad and Tobago is advancing cybersecurity legislation. But many Caribbean jurisdictions still lack comprehensive data-protection laws, mandatory breach-notification requirements, or cybersecurity-specific regulations. For organisations operating across multiple Caribbean territories – a common pattern in financial services, tourism, and manufacturing – the regulatory patchwork creates compliance complexity that is difficult to navigate without specialist advisory support.

The Interconnection Risk

Caribbean businesses are deeply interconnected – with each other, with international partners, and with global technology platforms. A breach at a single shared-services provider, a cloud platform, or a third-party vendor can cascade across multiple organisations simultaneously. The CARICOM Cybercrime and Cybersecurity Action Plan 2025 explicitly recognises this systemic risk, introducing a sixth pillar – Incident Response – to ensure that coordinated response mechanisms protect critical infrastructure across the region.

The False Sense of Security

Perhaps the most dangerous vulnerability is psychological. Many Caribbean executives believe their organisations are too small, too remote, or too insignificant to attract the attention of cybercriminals. This belief is dangerously wrong. Cybercriminals do not target organisations based on their size or prominence. They target organisations based on their vulnerability. A Caribbean SME with unpatched systems, weak passwords, no multi-factor authentication, and no incident-response plan is, from an attacker’s perspective, a perfectly optimised target: easy to breach, unlikely to detect the intrusion quickly, and poorly equipped to respond when the attack is discovered.

The Board’s Cybersecurity Agenda: Five Non-Negotiable Priorities

 

If cybersecurity is a boardroom issue – and it is – then the board needs a structured agenda for addressing it. The following five priorities represent the minimum that every Caribbean board should demand from management.

Priority 1: Know Your Risk Profile

The board cannot govern what it does not understand. Every Caribbean organisation needs a current, comprehensive cybersecurity risk assessment that identifies the organisation’s critical assets, maps the threats and vulnerabilities specific to those assets, quantifies the potential business impact of a breach, and evaluates the effectiveness of existing controls. This assessment should be conducted or validated by an independent cybersecurity specialist – not by the same IT team that built and manages the systems being assessed. The output should be a risk register that the board reviews quarterly, with clear risk-appetite statements that define the level of cyber risk the organisation is willing to accept.

Priority 2: Build a Defence-in-Depth Architecture

The era of perimeter-based security – where a firewall and an antivirus programme were considered adequate protection – is over. Modern cyber defence requires a layered architecture that assumes breach and is designed to detect, contain, and recover from attacks that penetrate the outer defences. For Caribbean enterprises, the practical components of a defence-in-depth architecture include multi-factor authentication across all systems, especially email and financial applications. Endpoint detection and response on every device connected to the network. Email security that filters phishing, business-email compromise, and malware delivery. Network segmentation that limits lateral movement after a breach. Encrypted backups stored offline, tested regularly for recoverability. Privileged-access management that restricts and monitors administrative credentials.

The investment required is not prohibitive. A mid-market Caribbean enterprise can deploy a competent defence-in-depth architecture for US$30,000 to US$80,000 in annual security tooling and managed-service costs – a fraction of the average US$2.09 million cost of a data breach in the Latin American and Caribbean region.

Priority 3: Prepare for the Breach That Will Happen

Every cybersecurity professional will tell you the same thing: it is not a question of whether your organisation will be breached, but when. The difference between an organisation that survives a breach and one that is devastated by it is preparation. This means developing and regularly testing a Cyber Incident Response Plan that defines exactly who does what, in what order, when a breach is detected. The plan should cover technical containment and forensic investigation, legal and regulatory notification obligations under each jurisdiction’s data-protection laws, communications to customers, employees, partners, and the media, business-continuity procedures for maintaining operations during the response, and evidence preservation for potential law-enforcement engagement.

The plan must be tested through tabletop exercises at least annually – simulated breach scenarios in which the leadership team practises decision-making under the pressure of a realistic cyberattack. Organisations that have rehearsed their response make faster, better decisions when a real incident occurs. Those that have not rehearsed typically discover the gaps in their plan at the worst possible moment.

Priority 4: Make People Your Strongest Defence

Technology alone cannot prevent cyberattacks. The overwhelming majority of breaches begin with a human action: clicking a phishing link, opening a malicious attachment, reusing a compromised password, or falling for a social-engineering scam. In a region where credential theft has surged 160 per cent and stolen credentials remain active for an average of 94 days, the human element of cybersecurity is not optional – it is foundational.

Caribbean organisations need ongoing, engaging cybersecurity awareness programmes that go beyond the annual compliance checkbox. Effective programmes include simulated phishing exercises that test and train employees in real-world scenarios, role-specific training for finance teams on business-email compromise and invoice fraud, executive briefings for the C-suite on social engineering and impersonation attacks, and a security-conscious culture where employees feel empowered to report suspicious activity without fear of blame.

Priority 5: Establish Continuous Monitoring and Intelligence

Cyber threats do not operate on business hours, and neither can cyber defence. The average time between initial breach and detection remains unacceptably long – measured in weeks or months, not hours. For Caribbean organisations that cannot maintain a 24/7 internal security operations centre, the practical solution is a managed detection and response service that provides continuous monitoring, threat intelligence, and rapid incident response as an outsourced capability.

This is where the digital-delivery model that Dawgen Global advocates becomes particularly powerful. A managed cybersecurity service delivered digitally from a regional base can provide enterprise-grade monitoring and response at a cost point that Caribbean mid-market organisations can sustain. The alternative – hoping that the IT team will notice an intrusion during business hours – is not a strategy. It is a gamble.

Caribbean Cybersecurity: The Compliance Landscape

 

Jurisdiction	Key Legislation	Breach Notification	Board Implication
Jamaica	Data Protection Act 2020 (active enforcement)	Required; penalties for non-compliance	Personal liability risk for directors
Barbados	Data Protection Act 2019	Required under Act provisions	Regulatory scrutiny increasing
Trinidad & Tobago	Data Protection Act 2011; Cybercrime Bill advancing	Evolving requirements	Financial services sector under heightened obligations
OECS States	Harmonised framework under CARICOM CCSCAP 2025	Being standardised regionally	Compliance gap creates reputational and trade risk
Cross-border	GDPR (for EU-serving firms); SOC 2; PCI-DSS	72-hour GDPR notification requirement	International partners demanding compliance evidence

 

The CARICOM Cybercrime and Cybersecurity Action Plan 2025 represents a watershed moment for regional cyber governance. Its six pillars – including the new Incident Response pillar – create a strategic framework that every Caribbean board should understand, because harmonised regional regulation is coming, and the organisations that prepare now will be ahead of the compliance curve.

From Cost Centre to Competitive Advantage

 

The narrative around cybersecurity has traditionally been one of cost: how much do we have to spend to avoid something bad happening? This framing is both incomplete and counterproductive. In the modern Caribbean business environment, cybersecurity is increasingly a competitive differentiator.

Financial-services firms that can demonstrate robust cybersecurity practices retain international correspondent banking relationships that competitors lose. Tourism operators that protect guest data build trust that translates directly into repeat bookings and premium pricing. Manufacturers that secure their supply-chain data maintain partnerships with international buyers who require cybersecurity compliance as a procurement condition. Professional-services firms that achieve recognised security certifications access client segments that less-secure competitors cannot.

The World Economic Forum’s 2026 report identifies a widening “cyber equity” gap between organisations that invest strategically in cybersecurity and those that do not. For Caribbean enterprises competing for international partnerships, investor confidence, and customer trust, which side of that gap you stand on is not a technical question. It is a strategic one.

IS YOUR BOARD ASKING THE RIGHT CYBERSECURITY QUESTIONS?

Dawgen Global’s Cybersecurity Advisory practice helps Caribbean organisations build board-level cyber governance, conduct independent risk assessments, design defence-in-depth architectures, develop and test incident-response plans, implement employee awareness programmes, and establish continuous monitoring capabilities – all delivered digitally, with deep Caribbean regulatory context, at pricing calibrated for regional realities.

Start the conversation: Email us : [email protected]

Dawgen Global  |  Borderless Advisory for a Boundless Region

“Embrace BIG FIRM capabilities without the big firm price.”

Borderless Advisory for a Boundless Region – The Series

Article 1: “The Borderless Advantage”

Article 2: “Surviving the Tariff Storm”

Article 3: “The Digital CFO”

Article 4: “Cybersecurity Is a Boardroom Issue” (You are here)

Article 5: “ESG Without the Greenwash”

Article 6: “The Talent Equation”

Article 7: “From Compliance Burden to Competitive Edge”

Article 8: “AI for the Caribbean Enterprise”

Article 9: “Climate-Proofing Your Balance Sheet”

Article 10: “Mergers, Acquisitions, and Strategic Alliances”

Article 11: “The Audit of the Future”

Article 12: “Vision 2030: A Strategic Blueprint for Caribbean Enterprise Competitiveness”

About Dawgen Global