Raphael John-Lall

Com­pa­nies and busi­ness­es in T&T need to de­vel­op more skills in de­vel­op­ing a plan to deal with the fall­out from ran­somware at­tacks and oth­er cy­ber­crimes.

This is the view of man­ag­ing di­rec­tor of Pina­ka Con­sult­ing, Shi­va Bisses­sar, who was re­cent­ly in Fin­land at­tend­ing a train­ing ses­sion in this area.

Over the last few years, sev­er­al promi­nent com­pa­nies and busi­ness­es in T&T have been the vic­tim of ran­somware at­tacks from the Na­tion­al In­sur­ance Board (NIBTT) to the Telecom­mu­ni­ca­tions Ser­vices of T&T (TSTT) to Ven­ture Cred­it Union.

The EU Cy­ber­Net Win­ter School took place from 14 to 16 Jan­u­ary 2026 in Helsin­ki, Fin­land and was or­gan­ised by the EU Cy­ber­Net, an EU-fund­ed project im­ple­ment­ed by the Es­ton­ian In­for­ma­tion Sys­tem Au­thor­i­ty and the Deutsche Gesellschaft für In­ter­na­tionale Zusam­me­nar­beit (GIZ) in co­op­er­a­tion with the Finnish Trans­port and Com­mu­ni­ca­tions Agency TRAFI­COM.

The EU Cy­ber­Net Win­ter School 2026 con­clud­ed af­ter three days of in­ten­sive learn­ing on man­ag­ing com­mu­ni­ca­tion in crises and ad­dress­ing chal­lenges in the age of ar­ti­fi­cial in­tel­li­gence to im­prove skills of EU Cy­ber­Net Ex­pert Pool mem­bers.

A ran­somware at­tack is a form of ma­li­cious soft­ware (mal­ware) that en­crypts a vic­tim’s files or locks their sys­tem, with the bad ac­tors de­mand­ing pay­ment—usu­al­ly in cryp­tocur­ren­cy—to re­store ac­cess. At­tack­ers of­ten steal da­ta first (dou­ble ex­tor­tion), threat­en­ing to re­lease it pub­licly if the ran­som is not paid.

Bisses­sar said busi­ness­es and the pub­lic, as well, seem to “un­der­es­ti­mate” the rise of these types of cy­ber­crimes.

“We’ve seen in Trinidad and To­ba­go, and the wider Caribbean, in­stances of ran­somware at­tacks, in­stances of oth­er type of cy­ber in­ci­dents. And what I have tak­en note of is there does seem to be a de­fi­cien­cy with re­spect to the com­mu­ni­ca­tion plan in man­ag­ing such an in­ci­dent,” he said.

He urged busi­ness lead­ers to meet with man­age­ment and de­vel­op plans in the case of cy­ber­at­tacks.

“They def­i­nite­ly have to plan for, in the event of a cy­ber in­ci­dent, what is the com­mu­ni­ca­tion plan with the pub­lic, with our share­hold­ers, with our board of di­rec­tors, var­i­ous stake­hold­ers of that busi­ness.”

More ac­tion need­ed

Based on the Glob­al Cy­ber­se­cu­ri­ty (GCI) In­dex 2024, Bisses­sar said T&T’s busi­ness com­mu­ni­ty and oth­er stake­hold­ers are not very well pre­pared for ran­somware and oth­er types of cy­ber­at­tacks.

Ac­cord­ing to this re­port, out of a max­i­mum of 20 points in the area of le­gal mea­sures, T&T scored 8.88. In the area of tech­ni­cal mea­sures, T&T scored 6.98. In the area of or­gan­i­sa­tion mea­sures, T&T scored 16.21.

Out of the five tier rat­ing sys­tem, T&T was giv­en a Tier 3 rank­ing.

“I be­lieve Trinidad and To­ba­go is in the third tier. A lot of the oth­er Caribbean coun­tries are in the sec­ond tier. But all that goes to say is that our ma­tu­ri­ty with re­spect to our in­for­ma­tion se­cu­ri­ty pos­ture, our cy­ber­se­cu­ri­ty pos­ture, is some­what lack­ing. And it is very im­por­tant to treat with cy­ber­se­cu­ri­ty as a risk that you need to man­age with­in your or­gan­i­sa­tion. Com­mu­ni­ca­tions is a crit­i­cal part of man­ag­ing that risk. And you do have to pre­pare for the even­tu­al­i­ty,” Bisses­sar said.

He re­ferred to re­cent ran­somware at­tacks in T&T and ad­vised busi­ness­es to pre­pare them­selves.

“If you’ve learned any lessons from the past in­ci­dents we’ve seen tak­ing place in Trinidad and To­ba­go, where vic­tims have been ex­ploit­ed by a ran­somware, you would recog­nise that there are de­fi­cien­cies that need to be ad­dressed. So, small and medi­um busi­ness­es, large en­ti­ties, they all need to cater for this type of risk. Even small mi­cro-en­ti­ties need to cater to this risk. Be­cause the at­tacks can take place at any time. They are tar­get­ed at­tacks. Of course, the larg­er your foot­print, the more at­trac­tive you are to at­tack­ers, of course,” Bisses­sar said.

He al­so said there is a view that cy­ber­at­tacks in T&T are even more preva­lent than what is re­port­ed in the me­dia.

“What you see in the news, of course, is not all of the at­tacks. You would on­ly see a small frac­tion re­port­ed of the at­tacks that have oc­cured. There is no oblig­a­tion on en­ti­ties right now to re­port, for ex­am­ple, in the ab­sence of leg­is­la­tion. These en­ti­ties may be get­ting at­tacked, and there’s no oblig­a­tion for them to re­port. Do we have a true pic­ture of risks be­ing man­i­fest via at­tacks in the lo­cal en­vi­ron­ment? I would say no, we don’t.”

He al­so called on busi­ness­es to lift their stan­dards and en­gage in more train­ing to pro­tect their them­selves.

“It is in­cum­bent up­on these small busi­ness­es, small and medi­um busi­ness­es, and the large en­ti­ties to recog­nise this risk, treat with the risk, put mea­sures in place to re­flect that in­for­ma­tion se­cu­ri­ty is thriv­ing through­out your or­gan­i­sa­tion.

Again, one met­ric is your or­gan­i­sa­tion­al struc­ture. Does it re­flect an in­for­ma­tion se­cu­ri­ty pos­ture? Do you have that spe­cial­i­sa­tion or seg­re­ga­tion of du­ties fo­cussing on in­for­ma­tion se­cu­ri­ty?”

Rais­ing stan­dards and adopt­ing in­ter­na­tion­al best prac­tice can help com­pa­nies and busi­ness­es be bet­ter equipped to en­ter re­gion­al and in­ter­na­tion­al mar­kets, he said.

“So, cer­ti­fi­ca­tion is some­thing that can be used by en­ti­ties that would like to sell in­to for­eign mar­kets, or pro­vide as­sur­ances to the do­mes­tic mar­ket. If you want to say, for ex­am­ple, look, you are pro­duc­ing soft­ware with­in the lo­cal mar­kets. And then the lo­cal mar­ket says you have to demon­strate that you’re pay­ing at­ten­tion to da­ta pri­va­cy. You have to demon­strate that you’re hold­ing oth­er peo­ple’s da­ta in a se­cure en­vi­ron­ment and not mis­us­ing the da­ta. How does an en­ti­ty do that? By at­tain­ing a cer­ti­fi­ca­tion like the ISO 27001 cer­ti­fi­ca­tion, you are able to demon­strate that.”

He al­so spoke about dire fi­nan­cial con­se­quences for busi­ness­es that are not pre­pared.

“The ran­somware game is, they will get in­to your net­work, they will en­crypt your da­ta to the point where you can­not use it and they will try to sell you a key. And that sell­ing of the key is the ac­tu­al thing that re­quires the ran­som to be paid, where the vic­tim now has to pay a ran­som to get those files, to get the de­cryp­tion key. There are ran­somware groups.”

Un­for­tu­nate­ly, he said crim­i­nals have now turned this in­to a busi­ness­es and it is even more rea­son why com­pa­nies and those in the le­git­i­mate busi­ness sec­tor need to pro­tect them­selves.

“So, this is not an in­di­vid­ual, this is a busi­ness, this is an ecosys­tem of at­tack­ers, of bad ac­tors. And why I say it’s an ecosys­tem, so for ex­am­ple, one guy may op­er­ate a call cen­tre, an­oth­er guy may op­er­ate the ini­tial en­try point in­to the net­work, he may spe­cialise in that. And they or­ches­trate ba­si­cal­ly an at­tack with­in a ran­somware group.”