BRA Collaborates with Authorities to Investigate Vehicle Registration System Breach

The Barbados Revenue Authority (BRA) is working with police to investigate a breach of its vehicle registration system, amid growing concerns over the security and privacy of stakeholders’ data.

Sensitive information from the system is reportedly circulating online, with a website claiming that vehicle registration records – along with tax records and other sensitive information – were being offered for sale.

In a statement issued on Tuesday afternoon amid reports that the BRA had been hacked, spokeswoman Carolyn Williams-Gayle said: “The Barbados Revenue Authority is aware that there is some vehicle registration application information circulating on the Internet and social media, and we are actively investigating the incident.

“The security and privacy of our stakeholders is of the utmost importance to us. The confidence and trust that individuals and businesses have in the Authority are the cornerstones of our systems, so we’re currently working with our partners and law enforcement to conduct a thorough investigation to determine the nature and scope of the reported incident.”

The breach has been linked to the online listing of 230 gigabytes of data on a Russian-language forum. According to a report from DataBreaches.net, the threat actor, identified as “Pryx”, claims to have accessed the BRA’s administrative portal and inserted malicious code, though it was reportedly not used.

The files being sold allegedly contain driver’s licences, passport and national ID numbers, phone numbers, and email addresses, with one document linked to a South Carolina driver’s licence, suggesting that the breach extended beyond Barbados.

“Pryx” reportedly made a ransom demand for the deletion of the data but has not received a response from the government.

According to DataBreaches.net, Pryx claimed that even if the government changed passwords, they might still be able to regain access if the authorities did not figure out how they were able to gain access in the first place.

Williams-Gayle said the BRA had notified Data Commissioner Lisa Greaves of the reported breach and gave an assurance the agency was committed to transparency.

Barbados TODAY reached out to Greaves but was told she is away until later this week.

The data breach also prompted swift action from the Ministry of Industry, Innovation, Science and Technology, which has launched its own investigation and deployed countermeasures to safeguard the systems. Minister Marsha Caddle sought to reassure the public that the breach appeared to be contained.