MINISTER without portfolio with responsibility for science, technology and special projects in the Office of the Prime Minister, Dr Andrew Wheatley has given Jamaica Electronic Transfer Services Limited (JETS) seven days to provide him with a comprehensive report on the cyber incident on its system last week.
In a media release last Friday JETS, which operates Jamaica’s MultiLink debit card and Automated Clearing House (ACH) networks, confirmed that sections of its system had been the subjected to a cyberattack.
According to JETS, the cyber attack involved a limited part of its internal administrative systems but the MultiLink and ACH networks were not affected and both remained fully operational.
On Monday Wheatley said that in a letter dated October 24 he wrote to JETS Chief Executive Officer Edmundo Jenez and Bank of Jamaica (BOJ) Governor Dr R Brian Langrin seeking further information on the cyberattack.
Wheatley noted that JETS operates the MultiLink network and, under management contract, ACH, which the BOJ recognises as a systemically important retail payment system.
He said given the critical infrastructure nature of these systems and the payment card and customer data in JETS’s custody, the Government regards the incident as a matter of national concern.
“Jamaicans rely on these networks every day to get paid, pay their bills, and buy what they need. When an operator of systems this important experiences a breach, the Government and the public are entitled to a full account of what happened, who was affected, and what is being done to ensure it does not happen again,” Wheatley said.
He has requested that JETS, with the support of the BOJ in the exercise of its oversight of the national payment system, submit a written report no later than October 31.
According to Wheatley, the report is to address: The nature and cause of the breach, including how access was gained; a full chronology of events, from the earliest evidence of attacker activity; the measures taken to detect, respond to and mitigate the breach; the data and the number of customers and cards affected; whether any ransom or other demand was made, and the actions taken in response.
Wheatley also wants to know the authorities and parties to whom the breach has been reported; steps taken to protect affected customers; remediation and lessons learned, including the findings of the independent forensic investigation; and technical threat information to be shared with the Cyber Incident Response Team (CIRT) Division so that other institutions can protect themselves.
Jamaica Electronic Transfer Services Limited, which operates the MultiLink debit card and Automated Clearing House (ACH) networks, confirmed last Friday that sections of its system had been subjected to a cyberattack, but both networks remained fully operational.
Wheatley said that pending the full report he has requested a preliminary briefing, within 72 hours, to himself, the CIRT Division, the Office of the Information Commissioner, and the Major Organised Crime and Anti-Corruption Agency.
He has also asked JETS to designate a senior point of contact to give immediate notice of any material development and to preserve all evidence relating to the incident.
“This request is not about assigning blame. JETS acted promptly to contain the incident and to inform the public, and that deserves recognition,” said Wheatley. “But no single institution can manage the consequences of an attack on critical infrastructure alone. The lessons from this incident must be understood and shared, and they will inform the initial work of the National Cybersecurity Coordination and Assurance Council in strengthening the protection of Jamaica’s critical information infrastructure.”
He said the letter makes clear that the report will be treated as confidential and that nothing in the request is intended to prejudice any criminal investigation.
JETS and the BOJ have indicated that the MultiLink and ACH networks were not compromised and continue to operate normally.
But Opposition spokesman on science, technology, and digital transformation Christopher Brown has expressed concern over the issue which, he said, may have exposed personal and financial information belonging to customers.
While noting JETS’s assurance that the MultiLink and ACH payment networks were not compromised, Brown said the potential exposure of customer names and debit card information raises legitimate concerns about data protection, cybersecurity safeguards, and the security of Jamaica’s critical financial infrastructure.
He pointed out that this incident comes against the background of the Government’s own disclosure that Jamaica recorded more than 49 million attempted cyberattacks in 2025 and another 5.4 million in the first quarter of 2026.
“We have heard repeated announcements about a National Cybersecurity Strategy and the establishment of a Cybersecurity Council. While these initiatives are important, we remain deeply concerned that the comprehensive legislative framework necessary to strengthen cybersecurity standards, institutional accountability, and the protection of critical digital infrastructure remains absent,” said Brown.
He underscored that, despite the escalating threats, Jamaica has still not enacted the proposed Cybersecurity Act.
