A Parliamentary Joint Select Committee has confirmed that the September 2023 cyberattack on the Government of Bermuda likely involved a ransom demand and ransom-related payment activity. In a 42-page report released today in Parliament, the bipartisan committee flagged approximately $4.415 million in "Cyber Incident 2023" budget line items and warned that their scale, timing, and description "require full explanation." The committee stopped short of declaring the full sum was paid as ransom but recommended referral to the Public Accounts Committee to trace exactly who was paid, and for what.
What Happened
In September 2023, the Government of Bermuda suffered a significant cyberattack that disrupted its digital environment. According to the newly released report, "All available indicators suggest that a ransom demand and ransom-related payment activity may have occurred." The committee identified two budget entries tied to the incident: roughly $3.092 million under Head 10, Ministry of Finance Headquarters, and roughly $1.323 million under Head 43, Information and Digital Technologies, for a combined total of approximately $4.415 million.
The bipartisan committee behind the report included PLP MP Lawrence Scott, PLP MP Scott Simmons, PLP MP Jamahl S. Simmons, and OBA MP Dwayne Robinson. While the committee declined to state, on the basis of the line items alone, that the entire amount was paid as ransom, it stressed that the "scale, timing, and description of those line items require full explanation." The committee also framed the spend against the alternative: rebuilding the government's affected digital environment without access to backups or original software could have cost between $25 million and $70 million in direct 2023 market costs, with severe-case exposure exceeding $100 million if critical data had to be manually reconstructed or legacy systems fully replaced.
What Was Taken
The report does not enumerate a specific dataset exfiltrated during the incident, but the profile is consistent with a ransomware event that impacted the availability of government systems and data. The committee's own cost modeling assumes a scenario in which backups and original software were inaccessible, and it references the possibility that "critical data had to be manually reconstructed." That framing points to encryption or destruction of core government data holdings rather than a purely disruptive outage.
The most sensitive question flagged by the committee is not what data was taken but where the money went. The report calls for the Public Accounts Committee to determine "whether the payment trail provides further evidence relevant to identifying parties involved in, facilitating, or benefiting from the cyberattack." That language signals concern that the financial records themselves may hold intelligence value, including whether cryptocurrency facilitation or intermediaries were involved.
Why It Matters
This report is a rare public-sector acknowledgment that a national government may have engaged in ransom-related payment activity, and it does so with unusual candor about the numbers. Bermuda's committee explicitly recommends that cybersecurity "must be treated as critical national infrastructure," a framing that positions a small-jurisdiction incident as a national-security matter rather than an IT problem.
For defenders, the report is a case study in the true cost calculus of ransomware. The committee's $25 million to $70 million rebuild estimate, versus a $4.415 million incident spend, illustrates exactly the economic pressure that drives victims toward payment when backups fail. It also demonstrates how the absence of tested, isolated backups can convert a recoverable incident into an existential financial event, and how that dynamic quietly shapes decision-making behind closed doors.
The Attack Technique
The report as summarized does not disclose the initial access vector, the ransomware family, or the threat actor responsible for the September 2023 intrusion. What can be inferred is that the attack rendered the government's backups or original software effectively unavailable, since the committee's cost analysis is built around a "no backups" recovery scenario. That is a hallmark of modern ransomware operations, which routinely target backup infrastructure and volume shadow copies before triggering encryption to maximize leverage.
The committee's referral list, which spans "ransom negotiation, decryption, data recovery, system restoration, forensic support, intermediaries, insurers, cryptocurrency facilitation, or similar activity," maps neatly onto the standard ecosystem of a double-extortion ransomware response. Until the Public Accounts Committee completes its work, attribution and technical specifics remain unconfirmed.
What Organizations Should Do
- Maintain immutable, offline, and regularly tested backups so recovery does not depend on paying an attacker. The gap between Bermuda's $4.4 million spend and a $25 million-plus rebuild estimate is precisely the gap resilient backups are meant to close.
- Harden and monitor backup infrastructure specifically. Segment backup networks, require separate credentials, and alert on mass deletion or encryption of backup stores.
- Establish a ransomware decision and governance framework in advance, including legal, financial, and disclosure obligations, so payment decisions are documented and accountable rather than improvised under duress.
- Treat cyber-incident spending as auditable. Tag incident-related expenditures clearly and retain forensic and financial records to support later investigation and to avoid opaque line items.
- Pre-arrange incident response retainers and validate that cyber insurance coverage aligns with realistic rebuild costs, not just ransom amounts.
- Classify critical government or business systems as critical infrastructure and prioritize them for segmentation, monitoring, and recovery planning, consistent with the committee's central recommendation.