CARICOM Threat Landscape Report 2026

Key Insights from CARICOM’s Cyber Threat Landscape

• Data Theft Dominates the Threat Landscape: Data breach and compromise account for 71.84% of all observed threat types, making stolen information the region’s primary cyber risk.
• Public Administration Faces the Greatest Exposure: Government organizations represent 35% of dark web targeting, followed by Educational Services (15.43%) and Finance and Insurance (13%).
• Mexico and Colombia See the Highest Threat Activity: Mexico accounts for 52.84% of dark web targeting, followed by Colombia (24.78%) and Venezuela (12.34%).
• Unauthorized Access Increases Ransomware Risk: Access-related threats account for 9.65% of activity, creating opportunities for follow-on ransomware attacks and data breaches.
• Ransomware Activity Remains Fragmented: More than 58% of ransomware activity is attributed to smaller or unidentified groups, making attacker behavior increasingly unpredictable.
• Financial Services Are the Primary Phishing Target: Finance and Insurance account for nearly 69% of phishing activity, placing regional financial institutions under significant pressure.
• Offshore Financial Centers Face Elevated Risk: Jurisdictions such as the Cayman Islands and British Virgin Islands remain attractive targets due to their global financial importance.
• HTTPS Is No Longer a Reliable Indicator of Trust: 71.9% of phishing pages use HTTPS, allowing malicious sites to appear more legitimate to users.

Why This Report Matters

The CARICOM cyber threat landscape is increasingly driven by financially motivated attacks focused on data theft rather than operational disruption. Government agencies, educational institutions, and financial organizations continue to experience sustained targeting because of the valuable information they hold. At the same time, access sales, ransomware, and phishing campaigns create additional risks that can quickly escalate into larger security incidents.

Organizations across the region need intelligence-driven visibility to identify emerging threats early, strengthen identity and access security, and improve resilience against increasingly sophisticated cybercriminal activity.

Take Action Now

• Dark Web Monitoring: Detect leaked data, credentials, and unauthorized access targeting your organization.
• Ransomware Intelligence: Track active ransomware groups and emerging campaigns across the CARICOM region.
• Phishing Detection & Response: Identify financial and government-focused phishing campaigns before credentials are compromised.
• Access Security: Strengthen MFA, monitor exposed services, and reduce credential-based attack risks.