No evidence of personal data breach following cyberattck on Bermuda’s information systems

Bermuda’s government experienced a major cyberattack last Thursday, severely impacting its information systems. However, the subsequent investigation into the incident, as stated by the government, has not revealed any signs of third parties accessing personal data.

Premier’s assurance

Premier David Burt addressed the public through a news conference, reassuring citizens that initial investigations show no signs of compromised data.

The premier stated that a comprehensive forensic investigation is currently underway to pinpoint any possible infiltration. The international team assigned to evaluate the cyber incident has not found any forensic evidence pointing toward data exfiltration so far.

Proactive measures amid uncertainty

Burt further cautioned that the process is ongoing, and discoveries may still occur. In the event of identifying a breach, he said that the government commits to acting swiftly, notifying affected individuals, and taking necessary action in the best interests of Bermuda’s citizens.

The government encourages all citizens to remain vigilant against phishing attempts and advises regular password updates as protective measures against potential cybersecurity threats.

Commitment to transparency and legal compliance

The Bermuda Government has vowed to keep the public informed, promising to release accurate and timely information once they have a clearer understanding of the accessed data, if any.

The government will also shared that engagement with the Privacy Commissioner and corresponding international authorities will be made as required, ensuring that all necessary notifications are dispatched and appropriate actions are taken.

Privacy Commissioner weighs in

Privacy Commissioner Alexander White highlighted the importance of organizations informing individuals about security breaches, pointing to the obligation as not just a legal requirement but a protective measure for citizens.

White stated that these notifications serve as warnings to individuals, helping them act protectively, and as communication from organizations about the steps being taken to mitigate potential adverse effects.

Future legal requirements

Under personal information protection laws, organizations in possession of private data on individuals must contact the Privacy Commission if they have been the victim of a cyberattack. They must then notify any individual who may be affected by the breach.

However, those rules do not come into effect until January 2025.