Bahamas Issues Cybersecurity Alert Over Akira Ransomware Threat

Nassau, The Bahamas, October 22, 2026 — The National Computer Incident Response Team of The Bahamas (CIRT-BS) has issued a cybersecurity advisory warning businesses, government institutions and other organisations about the growing threat posed by Akira ransomware, a cybercriminal operation capable of stealing sensitive information, disrupting networks and demanding ransom payments.

Active since March 2023, Akira operates through a Ransomware-as-a-Service model, with affiliates exploiting weaknesses in computer networks to gain unauthorised access.

Once inside, attackers can steal confidential data, disable recovery systems and encrypt files, preventing organisations from accessing critical information.

Particularly concerning is Akira’s use of double extortion, threatening to publish stolen information unless victims pay. Some attacks involve data theft without encryption.

The October 22 advisory identifies vulnerabilities involving Cisco and SonicWall firewalls, VPN services, Microsoft Remote Desktop Protocol, Veeam backup systems and outdated Windows and Linux operating systems. VMware ESXi and Nutanix AHV environments are also potential targets.

Attackers may exploit unpatched software, stolen login credentials and inadequately secured remote-access applications, including AnyDesk and RustDesk.

Warning signs include unexpected administrator accounts, unusual remote logins, unauthorised software installations, suspicious backup activity, mass file changes and ransom notes.

CIRT-BS recommends immediate security updates, multifactor authentication, restricted remote access, stronger network monitoring and secure backups maintained separately from operational systems.

Organisations should also remove unnecessary internet exposure of remote desktop services, limit administrative privileges and regularly test backup restoration.

The advisory does not identify any confirmed Akira attack against a Bahamian organisation but highlights vulnerabilities that could expose institutions to serious financial and operational disruption.

Cybersecurity incidents can be reported to CIRT-BS at soc@cirt.bs or through its official website.