JAMAICA · CYBERSECURITY
Key Facts
- —The country Jamaica is an English-speaking Caribbean island nation whose banks route debit card and bank-to-bank payments through two shared networks run by JETS Limited.
- —Why it matters Debit card numbers and customer names may have been exposed at the company that runs those networks, which is why the central bank is warning account holders about fraud and phishing.
- —Why now JETS Limited confirmed the breach in a statement that Jamaican newspapers carried on Friday 23 October 2026, and the Bank of Jamaica issued its own warning the same day.
- —What happened Hackers reached part of JETS’s internal administrative systems, and the company says the files may hold historical debit card numbers and the names of some customers who received ACH transfers.
- —The numbers JETS says both payment networks, MultiLink debit and the ACH, were not compromised, and three card details (PINs, CVVs and expiry dates) were not exposed.
- —What it means for you Anyone with a Jamaican bank account or debit card, including Jamaicans abroad, should check statements and ignore unsolicited calls or texts about cards.
- —Still open How many customers and cards are affected, who the attackers are, and whether Jamaica can speed up its still unwritten Cybersecurity Act.
The Jamaica data breach at JETS Limited, the company that runs the country’s MultiLink debit card and Automated Clearing House (ACH) bank-transfer networks, may have exposed historical debit card numbers and customer names, the company has confirmed. JETS says the payment networks themselves were not compromised and remain fully operational, while the Bank of Jamaica, the central bank, has told customers to watch for fraud.
For US readers the exposure matters most to Jamaicans abroad and to Americans with family or business accounts at Jamaican banks, because the data in question covers debit card numbers and the names of people who received ACH transfers. Neither JETS nor the central bank has said whether foreign-issued cards or overseas senders are affected.
The disclosure comes five days before Jamaica’s national cyber exercise, CyberXJM26, which begins on 28 October. It also follows remarks, made after a 30 September post-Cabinet press briefing, in which the head of the government’s Cyber Incident Response Team said Jamaica has no cybersecurity act.
How the Jamaica Data Breach Unfolded
JETS says its Cyber Monitoring Team detected suspicious activity inside a limited section of its domain and immediately shut down the affected administrative system, isolated the area and began a full forensic investigation. The company describes the incident as limited to part of its internal administrative systems.
The investigation, run with specialist cybersecurity consultants, has found no evidence that the MultiLink or ACH networks were compromised, JETS says. It adds that PINs, card verification values (CVVs) and card expiry dates were not accessible, because its systems never store them.
JETS says it has told the Bank of Jamaica, the Office of the Information Commissioner, the police, cybersecurity experts and its member financial institutions. Opposition spokesperson Christopher Brown has urged the Information Commissioner’s office to make sure Jamaica’s existing Data Protection Act is fully observed.
The newspapers differ slightly on timing, because The Gleaner dates the JETS statement to Thursday while The Gleaner’s report on the central bank statement says JETS reported the breach on Friday 23 October. The Jamaica Observer carried the confirmation on Friday morning.
What Data May Be Exposed
JETS says the files the hackers reached may contain historical debit card numbers held in administrative data of the debit network, along with the names of some customers who received transfers through the ACH network. The company has not said how many cards or customers are involved, or how far back the historical data goes.
The Bank of Jamaica says PINs, CVVs and expiry dates were not affected because those details are not stored in the systems involved. It warns that fraudsters may use calls, texts, emails or social media messages that claim to come from banks, JETS or the central bank itself.
Bank of Jamaica Warns Customers
The Bank of Jamaica says MultiLink and the ACH remain fully operational, so customers can keep using debit cards and making ACH payments as normal. It says it is working closely with JETS, member financial institutions and national partners, and that it backs JETS’s decision to inform the public.
The central bank asks customers to review accounts and card transactions online, watch bank alerts and report unfamiliar transactions promptly. It also says never to share PINs, CVVs, one-time passwords or online banking logins, because legitimate institutions would not ask for them.
Anyone with a concern should call their financial institution on the number printed on the back of the card or published on its official website, the central bank advises. It says further updates will be provided as necessary.
Why Jamaica’s Cyber Law Gap Is in Focus
Brown, the opposition spokesperson on science, technology and digital transformation, said the breach shows the need for stronger protection and called on the government to speed up the Cybersecurity Act with a clear timetable. He pointed to the government’s own figures of more than 49 million attempted cyberattacks in 2025 and 5.4 million in the first quarter of 2026.
The government accepts the gap, since Godphey Sterling, director of the Cyber Incident Response Team (CIRT) Division, told the Jamaica Information Service (JIS) on 2 October that Jamaica has no cybersecurity act. Cabinet must still approve drafting instructions, and Sterling said the aim is to shorten the process to two years, which he called “a best hope.”
Minister Andrew Wheatley told parliament on 2 June that a data breach on a major government digital platform had exposed the personal information of hundreds of thousands of Jamaicans, and that a US$10 million cybersecurity project had been approved. He said the national cybersecurity standards framework was complete and the national cyber incident response plan tested.
The CIRT Division’s national exercise, CyberXJM26, starts on 28 October with a 24-hour online qualifying round and a simulation of how agencies coordinate during a multi-sector incident. Sterling said the design draws on problems that followed Hurricane Melissa, including disrupted infrastructure and the need for satellite connectivity.
What It Means for You
If you hold a Jamaican debit card or bank account, check your statements and online banking now, and treat unexpected calls, texts or emails about your card as suspect. Do not share a PIN, CVV or one-time password with anyone who contacts you first.
The JETS and central bank statements do not mention foreign-issued cards and address Jamaican customers. Visitors and expats with a local account or debit card should follow the same checks.
For wider context, see our Jamaica Politics Explained guide, our explainer on Jamaica in Latin America and our report on six people charged in a Jamaica loan fraud case. Residents can find banking and daily costs in our Kingston expat city guide.
What Is Not Known
JETS has not said how many debit cards or ACH customers are affected, which member banks are involved, or how far back the historical data goes. It has not said when the intrusion began or was detected, and the two newspapers differ on whether its statement came on Thursday or Friday.
No group has claimed responsibility in the sources reviewed, and no report of fraud on an affected card has appeared. The forensic investigation is continuing, so the findings that the networks were not compromised and that PINs, CVVs and expiry dates are safe rest on information that JETS supplied.
JETS’s own statement and a Bank of Jamaica press release could not be opened on their websites when this was written, so the account rests on The Gleaner and the Jamaica Observer. The two papers also expand the JETS name differently, so this article uses only JETS Limited.
Frequently Asked Questions
What is the Jamaica data breach at JETS?
JETS Limited, which runs Jamaica’s MultiLink debit card and ACH networks, says hackers reached part of its internal administrative systems. The files may hold historical debit card numbers and the names of some customers who received ACH transfers.
Are the payment networks safe to use?
The Bank of Jamaica says MultiLink and the ACH remain fully operational and customers can use cards and make payments as normal. JETS says its investigation found no evidence that either network was compromised.
Were PINs and security codes exposed?
JETS and the central bank say PINs, CVVs and card expiry dates were not exposed, because those details are not stored in the systems involved. The forensic investigation is still under way.
What should customers do now?
Review account and card activity online, watch bank alerts and report anything unfamiliar to your financial institution at once. Never share a PIN, CVV or one-time password, and call your bank on the number printed on your card.
Does Jamaica have a cybersecurity law?
Jamaica amended its Cybercrimes Act in 2026, but the head of the government’s Cyber Incident Response Team said on 2 October that there is no cybersecurity act. The government aims to shorten the process of creating one to two years.
Sources: The Gleaner, JETS Limited statement, 23 October 2026; The Gleaner, Bank of Jamaica statement, 23 October 2026; Jamaica Observer, 23 October 2026; Jamaica Observer, Christopher Brown statement, 23 October 2026; Jamaica Information Service, 2 October 2026; Jamaica Information Service, 16 October 2026; Jamaica Information Service, 3 June 2026.
Editorial responsibility: Matthias Camenzind, Editor-in-Chief · Editorial standards · Report an error