MalwareFinancial ServicesFinanceRansomwareData ExfiltratedRansom DemandedIdentity (basic)Government IDFinancial accountMediumContained

Jamaica National Group Limited and Jamaica National Bank

bd_504b1695620366d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 14, 2020

Filed

Mar 30, 2020

To disclose

16 days

Affected

3state residents only

Confidence

66%

Full breach record for Jamaica National Group Limited and Jamaica National Bank →

Jamaica National Group Limited reported a ransomware attack on March 14, 2020. Unauthorized access potentially exposed customer PII (names, IDs, proof of address) and credit card details. The company notified police, regulators, and credit card suppliers, engaged forensic investigators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 days

Mar 14, 2020

Begins

Mar 14, 2020

Discovered

Mar 30, 2020

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Jamaica National Group Limited and Jamaica National Bank
norm: jamaica national group limited and jamaica national bank
Domain: jngroup.com

Name: Jamaica National Group Limited and Jamaica National Bank
norm: jamaica national group limited and jamaica national bank
Domain: jngroup.com
Industry: Financial Servicesllm

Discovered: Mar 14, 2020
Breach occurred: Mar 14, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 30, 2020
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Advised the regulatory agencies in all countries in which we operate

During the incident: Notified the Police and security agencies locally and overseas
Advised relevant banks
Advised our credit card supplier, which is doing enhanced monitoring of credit card transactions
Undertaken a complete review of our IT systems to further strengthen our infrastructure
Appointed a specialist IT security and forensic provider to investigate the incident
Implemented a special email address [REDACTED-EMAIL] to support customers who may have queries
Established a process to help customers through this period, which could include credit remediation and identity protection services, such as LifeLock and Identity Force for a period of 12 months
Changes made: Implemented a special email address [REDACTED-EMAIL] to support customers who may have queries
Established a process to help customers through this period, which could include credit remediation and identity protection services, such as LifeLock and Identity Force for a period of 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-148.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2020
Raw hash: 3146bea6e8774cd9037328d435e3f88ce3499e3148fd0f8bc0fb5fceeba66a5c

Reporting entityJamaica National Group Limited and Jamaica National Bank

Victim entityJamaica National Group Limited and Jamaica National Bank

Incidentdiscovered Mar 14, 2020

Stated responseNotified the Police and security agencies locally and overseas

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov