> ## Content Index
> Fetch the complete content index at: https://www.lacaribenanews.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# The Bahamas Warned Its Businesses About a Ransomware Group Absent From the FBI Advisory and From the Region's Own Count. The Caribbean Logged 21 Attacks in Six Months.
- URL: https://www.lacaribenanews.com/bahamas-cirt-akira-ransomware-advisory-caribbean-smes-2026/
- Published: 2026-10-24T22:51:55.000Z
- Updated: 2026-10-25T05:18:46.000Z
- Description: The National Computer Incident Response Team of The Bahamas issued an Akira ransomware alert on 22 October 2026, naming no confirmed attack at home. The FBI and three other agencies put the group's proceeds at US$244.17 million, and record its victims in North America, Europe and Australia. The Cari
- Author: Theon Alleyne
- Tags: Wire, CELAC Wire, Bahamas, Cybersecurity, Compliance, MSME, Business

**Quick summary:** The National Computer Incident Response Team of The Bahamas issued an Akira ransomware alert on 22 October 2026, naming no confirmed attack at home. The FBI and three other agencies put the group's proceeds at US$244.17 million, and record its victims in North America, Europe and Australia. The Caribbean logged 21 ransomware listings in six months.

By LCN Wire

The Bahamas has told its companies to patch their firewalls, turn on multifactor authentication and keep a backup the attacker cannot reach.

It did so during its own National Cyber Security Awareness Month, and without a single confirmed case at home.

## What did The Bahamas actually issue?

An advisory from its national incident response team, dated 22 October, to businesses and government alike.

CIRT-BS published it on its own LinkedIn account, in its own words: "The Akira ransomware group continues to pose a significant threat to businesses and organisations by exploiting vulnerabilities in commonly used systems to gain unauthorised access, steal sensitive information and disrupt operations."

It did not publish it on its website. As the team's Alerts page stood on 24 October, the Akira notice was on neither that page nor the News and Press page beside it, and the newest entry on the Alerts page was dated 14 October.

The page is where this class of document normally goes. It carries an advisory on the FortiBleed credential leak and thousands of exposed Fortinet VPN devices, and a smishing alert about fake text messages targeting The Bahamas, dated 19 August.

The alert names no Bahamian victim. It describes what the group does and which systems it reaches, and it reports no incident in the country. [Magnetic Media](https://magneticmediatv.com/2026/10/bahamas-issues-cybersecurity-alert-over-akira-ransomware-threat/?ref=lacaribenanews.com), reporting from Nassau, put the same point in the negative: the advisory "does not identify any confirmed Akira attack against a Bahamian organisation".

The notice is specific about where the doors are. Its own graphic, headed "Ransomware Alert", groups them as remote access tools, firewalls and VPNs, operating systems and virtualisation, and security controls, and names the products: Microsoft Remote Desktop Protocol on TCP 3389, AnyDesk, RustDesk, SonicWall running SonicOS, and Cisco ASA and FTD.

The fourth group is the one a reader should notice. Under security controls the team lists endpoint detection and logging, because the attacker disables or tampers with them. The tooling an organisation buys to see an intrusion is itself a target.

The notice also covers Veeam backup systems, outdated Windows and Linux, and VMware ESXi and Nutanix AHV environments, with entry through unpatched software and stolen credentials.

## What does the primary document say about this group?

That it has taken US$244.17 million, and that it has not been recorded here.

The [joint advisory of the FBI, CISA, the Defense Cyber Crime Center and the Department of Health and Human Services](https://www.fbi.gov/file-repository/cyber-alerts/stopransomware-akira-ransomware.pdf?ref=lacaribenanews.com), product AA24-109A, was published on 18 April 2024 and updated on 13 November 2025 with activity the agencies say "presents an imminent threat to critical infrastructure".

It records that as of late September 2025, Akira had claimed approximately US$244.17 million in ransomware proceeds. It started in March 2023 and has run as a Ransomware-as-a-Service operation, practising double extortion, and the agencies associate it with Storm-1567, Howling Scorpius, Punk Spider and Gold Sahara, with possible connections to the defunct Conti group.

**Its recorded geography is "North America, Europe, and Australia".** The words Caribbean, Bahamas and Latin America appear nowhere in the document.

## Who does Akira go after?

Small and medium-sized businesses come first, on the agencies' own account.

The advisory states the group "primarily target\[s\] small- and medium-sized businesses", while also reaching larger organisations, with a stated preference for manufacturing, educational institutions, information technology, healthcare and public health, financial services, and food and agriculture.

That profile is the Caribbean's business population, not an exception to it. A firm with one server room, one administrator and a backup on the same network is the described target, and the region is full of them. Those firms already [wait ninety days to be paid while India built a fix for the same problem](https://www.lacaribenanews.com/the-90-day-wait-why-caricom-small-businesses-starve-for-cash-while-india-quietly-built-a-fix/), and a hundred of them opened in Georgetown this week [selling through a QR code and a mobile-money payment](https://www.lacaribenanews.com/gcci-national-small-business-week-expo-railway-courtyard-2026/). Each new system is another door.

## What changed in the group's capability?

It learned to encrypt a second kind of virtual environment, through a firewall flaw.

In a June 2025 incident the agencies record Akira encrypting Nutanix AHV virtual machine disk files for the first time, extending beyond VMware ESXi and Hyper-V by abusing CVE-2024-40766, an improper-access-control vulnerability in SonicWall.

CIRT-BS names both Nutanix AHV and SonicWall in its own list. The Bahamian advisory is tracking the instrument.

## What does the advisory ask organisations to do?

Patch what is known to be exploited, enforce phishing-resistant multifactor authentication, and keep an offline backup whose restoration has been tested.

Those three sit at the very top of the joint advisory, above the technical detail and above the indicators of compromise.

CIRT-BS adds restricted remote access, stronger network monitoring, backups kept separate from operational systems, removing unnecessary internet exposure of remote desktop services, limiting administrative privileges and testing that a restore actually works. Its warning signs are the ones an administrator can see without a tool: unexpected administrator accounts, unusual remote logins, software nobody installed, odd backup activity, mass file changes and a ransom note.

Incidents in The Bahamas can be reported to CIRT-BS at soc@cirt.bs.

## Where does that leave the rest of the region?

With a ransomware problem it has measured itself. Akira has been operating since March 2023, and it is not named once in the region's 2026 report.

The Computer Forensics and Security Institute publishes a Caribbean ransomware report built from monitoring ransomware groups' dark web leak sites. Its mid-year edition, by Shiva V.N Parasram, counts **21 confirmed attack listings in the first half of 2026, equalling the total for the whole of 2025 in six months**, by 12 distinct groups across five countries and territories.

The listings fall as the Dominican Republic 7, Jamaica 6, **The Bahamas 5**, Turks and Caicos 2 and Bermuda 1\. LockBit, including its v5 variant, was the most active with four; Payload had three. **Eight of the twelve groups had no Caribbean presence at all in 2025.**

Food production and government each saw three attacks, joining finance and tourism as the most targeted sectors. Tourism is the sector the region has spent the month arguing about how to fund, from [Jamaica's proposed Caribbean visitor levy](https://www.lacaribenanews.com/caribbean-tourism-resilience-fund-bartlett-visitor-levy-sotic-2026/) to [the offices filled at the tourism organisation's meeting in Georgetown](https://www.lacaribenanews.com/cto-leadership-elected-georgetown-antigua-chair-guyana-member-2026/). One organisation may have paid and was then delisted. A government law enforcement agency was listed as a victim. Leaked proof-of-compromise data from one attack contained the passport biodata of a citizen of another Caribbean country. Stolen records surface in places a government may find before the company tells anyone: a Mexican ministry [found the Aeroméxico data on Telegram itself](https://www.lacaribenanews.com/aeromexico-buen-gobierno-telegram-monitoring-inai-sec-silence-2026/).

**Akira is named nowhere in that report, and neither is Guyana.**

## What do those two absences actually mean?

The report bounds both of them itself: it counts only what reaches a leak site.

It records only what is published on leak sites. In its own words, organisations which pay ransoms "are typically delisted or never published", so the real number of Caribbean attacks in the period is "likely significantly higher". An absence from a leak-site count is an absence from a leak-site count.

So the position is narrow and worth stating exactly. Akira does not appear in the United States advisory's geography, and does not appear in the region's own leak-site monitoring. The Bahamas has issued an advisory about it anyway, in a half-year when five Bahamian organisations were listed by other groups and eight groups arrived in the region that had not been here the year before.

## Who else in the region has published on this?

On the public record this newspaper can find, no regional body has issued one.

The CARICOM Implementation Agency for Crime and Security (IMPACS) has published no advisory on Akira or on ransomware. Its cyber output runs to a partnership with Dominica, an exploration of collaboration with Korea's KISA, a discussion with Trinidad and Tobago's CSIRT, and institutional readiness. The agency [has a cyber plan, and critical infrastructure remains the gap in it](https://www.lacaribenanews.com/caribbean-cybersecurity-critical-infrastructure-caricom/).

National teams are where the work sits. The Bahamian one issued this advisory, and Trinidad and Tobago has a CSIRT that IMPACS has met this year. What any of them can do at two in the morning when a system stops responding depends on national capacity, not on the regional plan. In Guyana, police told a Georgetown symposium this week that attacks on the country passed a million in six months, while the Commissioner's [2025 prosecution figures record no conviction for computer-related fraud](https://www.lacaribenanews.com/guyana-cybercrime-convictions-2025-fraud-none-police-symposium-2026/).

The disclosure question sits apart from all of it and is unsettled. Aeroméxico [disclosed its data breach in Mexico and had not reported it to the Securities and Exchange Commission](https://www.lacaribenanews.com/aeromexico-breach-sec-form-6-k-disclosure-caribbean-2026/), which is the position a regional company reaches the moment an incident touches a market with reporting duties attached.

### The entities

- **National Computer Incident Response Team of The Bahamas (CIRT-BS)** issued the alert of 22 October 2026 and receives incident reports at soc@cirt.bs.
- **National Cyber Security Awareness Month** is the Bahamian campaign running through October 2026, which the alert was issued during.
- **Endpoint detection and logging** are the security controls the alert says attackers disable or tamper with.
- **Akira** is a ransomware operation running since March 2023 on a Ransomware-as-a-Service model.
- **Joint advisory AA24-109A**, "#StopRansomware: Akira Ransomware", is the primary document, published 18 April 2024 and updated 13 November 2025.
- **Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Defense Cyber Crime Center (DC3) and Department of Health and Human Services (HHS)** are its co-authors.
- **Double extortion** is the practice of threatening to publish stolen data as well as encrypting it.
- **CVE-2024-40766** is the SonicWall improper-access-control vulnerability abused in the June 2025 Nutanix incident.
- **VMware ESXi** is the virtualisation platform Akira first reached beyond Windows, with **Hyper-V** and **Nutanix AHV** added since.
- **AnyDesk and RustDesk** are the remote-access tools CIRT-BS names as potential entry points.
- **Computer Forensics and Security Institute (CFSI)** publishes the Caribbean ransomware report built from dark web leak-site monitoring.
- **Shiva V.N Parasram** is its author.
- **LockBit** and **Payload** are the two most active groups in that report's Caribbean count.
- **CARICOM Implementation Agency for Crime and Security (IMPACS)** is the regional body carrying the cyber plan.

### What the title card shows

Every data point on the article's title card, in text.

- **US$244.17 million.** Akira's claimed proceeds as of late September 2025\. Source: joint advisory AA24-109A.
- **March 2023.** When the group became active. Source: joint advisory AA24-109A.
- **22 October 2026.** The date of the Bahamian alert, published on LinkedIn during National Cyber Security Awareness Month. Source: CIRT-BS and Magnetic Media.
- **14 October 2026.** The newest entry on the team's own Alerts page as it stood on 24 October. Source: CIRT-BS.
- **None.** Confirmed Akira attacks on a Bahamian organisation named in the alert. Source: CIRT-BS, corroborated by Magnetic Media.
- **North America, Europe and Australia.** The geography the FBI advisory records. Source: joint advisory AA24-109A.
- **13 November 2025.** When the joint advisory was updated for activity called an imminent threat to critical infrastructure. Source: joint advisory AA24-109A.
- **21 listings.** Confirmed Caribbean ransomware attack listings in the first half of 2026, equalling the whole of 2025\. Source: CFSI.
- **Zero.** Mentions of Akira in that Caribbean report. Source: La Caribeña News, from the full text.

## Frequently Asked Questions

### Has Akira ransomware attacked a Bahamian organisation?

Not on the alert's own account. The CIRT-BS alert of 22 October 2026 names no Bahamian victim and sets out the systems the group reaches. Magnetic Media reported that it "does not identify any confirmed Akira attack against a Bahamian organisation" and instead highlights vulnerabilities that could expose institutions to financial and operational disruption.

### How much money has Akira taken?

Approximately US$244.17 million as of late September 2025, according to joint advisory AA24-109A by the FBI, CISA, DC3 and HHS.

### What systems does the advisory say are exposed?

CIRT-BS names Cisco and SonicWall firewalls, VPN services, Microsoft Remote Desktop Protocol, Veeam backup systems, outdated Windows and Linux systems, and VMware ESXi and Nutanix AHV environments, with entry through unpatched software, stolen credentials and remote-access tools including AnyDesk and RustDesk.

### Where did CIRT-BS publish the Akira alert?

On its own LinkedIn account, on 22 October 2026, during National Cyber Security Awareness Month. As the team's website stood on 24 October, the alert was on neither its Alerts page nor its News and Press page, and the newest Alerts entry was dated 14 October.

### Does the Caribbean have a ransomware problem without Akira?

Yes. The Computer Forensics and Security Institute counted 21 confirmed attack listings across the region in the first half of 2026, equalling the total for all of 2025, by 12 groups across five countries and territories. Eight of those groups had no Caribbean presence in 2025\. The report counts only what appears on dark web leak sites and says the true figure is likely significantly higher.

### What should a small business do first?

The agencies put three actions before all others: remediate known exploited vulnerabilities, enable and enforce phishing-resistant multifactor authentication, and keep regular backups stored offline with the restoration process tested.