Turks and Caicos government recovers from pre-Christmas ransomware attack

The Turks and Caicos Islands Government was hit by a ransomware attack on December 18, 2024 and warned residents the following day. On December 24 it confirmed that several segments of its network had been compromised and shut down digital services to contain the intrusion.

The disruption reached welfare payments, tax collection and motor vehicle licensing, and departments across government reverted to manual processing. A Cabinet briefing on December 30 said business continuity arrangements were prioritizing social welfare, scholarship, healthcare, cost of living, salary and utility payments, and that a number of services including passports, the elections database, driver's license issuance, airport passenger processing and customs clearance were operating.

The territory engaged external forensic investigators and cybersecurity specialists, with the investigation funded by the United Kingdom government, and deployed a managed threat detection and response capability across its network. Technical oversight was supported by specialists from other British overseas territories.

The Record reported that the government's payment system was restored on January 6, 2025 and that several further platforms returned on January 8, while some systems remained offline with no published restoration date. No ransomware group publicly claimed the attack. Opposition politicians criticized the administration over the absence of firewalls and cyber insurance and pressed for public briefings.