BRH warns of cyberattacks and bans ransom payments
Two weeks after the Capital Bank outage, the BRH says cyberattacks are targeting Haiti's financial system and that no bank may negotiate with cybercriminals.
The Banque de la République d'Haïti (BRH) published a notice to the public on October 19 about cyberattacks, which it says have grown to an "unprecedented" scale in the region and worldwide over the past five years. "These cyberattacks do not spare Haiti and particularly target its financial system," writes governor Ronald Gabriel.
The notice does not name any institution. It comes two weeks after Capital Bank lost its branches, online banking and ATMs to an IT outage, which the ransomware group LockBit 5.0 has claimed. The bank has still not confirmed a cyberattack.
What the BRH says
- No ransom. The BRH does not authorise any financial institution in the country to negotiate with cybercriminals who demand a ransom.
- Continuity first. After an incident, banks should activate their contingency and business continuity plans, then strengthen their systems based on what the forensic analysis finds.
- Rules and oversight. Haitian financial institutions must already run reliable, secure information systems, and the BRH says it checks that they protect customer data.
- Training. Since 2023, the central bank has pushed for stronger IT systems through cybersecurity training and awareness.
A global crime, a local target
Ransomware groups work across borders, often from countries where they face little risk of arrest, and they pick victims for what they can extract, not for where they are. Latin America and the Caribbean have become a growing target: Recorded Future's Insikt Group counted 452 ransomware incidents in the region in 2025, with government among the five most-hit sectors.
For a country like Haiti, the cost of an attack is higher than the ransom. Many people rely on a handful of banks and two mobile money networks, cash is hard to move safely, and an outage at one bank can cut a business off from its money for days. The specialists who can investigate and rebuild systems are few, and police and courts have limited means to pursue attackers who operate abroad.
Ruling out ransom payments removes one incentive for attackers, but it puts the weight on prevention: tested backups, segmented networks, and staff who can spot a phishing email. The BRH notice says that is the direction it expects banks to take.
What customers can do
- Treat calls, texts and emails that mention a bank incident with suspicion. Your bank will not ask for your password or PIN.
- Check your account activity regularly.
- Rely on your bank's official channels for news about its services.
