# Caribbean Shared-Platform Compromises Cascade Into Global Cyber-Risk (Curaçao Government Ransomware, July 2025)

> On July 24, 2025 Curaçao's Tax and Customs Administration (Belastingdienst) discovered ransomware on its network, shutting counters, call center and internal processes for about ten days. A day earlier the Joint Court of Justice, which serves six Dutch Caribbean jurisdictions, took its network down after a virus was detected, and Aruba's Parliament reported a compromised email account in the same window.

- **Published:** 2026-10-23T14:36:15Z
- **Last reviewed:** 2026-10-23T14:36:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4272
- **ID:** TL-2026-4272
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-6543

## Description

Dark Reading's regional risk analysis argues that in the Caribbean a single shared platform can affect multiple governments, so one compromise cascades across jurisdictions. It cites Fortinet's Global Threat Intelligence reporting of roughly 325 million attack attempts across the English-speaking Caribbean in 2025, and says critical vulnerabilities are now targeted within 24-48 hours of disclosure (previously nearly five days). The analysis also treats annual third-party assurance as a control-design gap. Note: the Dark Reading page returned HTTP 403 to direct fetch, so these article claims are taken from the search-result summary and the hunt skeleton; the 325 million figure could not be independently confirmed in Fortinet material.

Incident facts were corroborated through other outlets. Curaçao's Tax and Customs Administration discovered ransomware on Thursday July 24, 2025. The finance minister, Javier Silvania, authorized Dutch cybersecurity specialists to assist, and the news first appeared on his Facebook page. In-person services, customer counters and the call center were closed and multiple internal systems were isolated; the online platform for filing and paying taxes stayed operational. Officials stated there were no indications that confidential data had been stolen, leaked or lost. Services reopened Monday August 4, 2025, with technical issues possibly persisting. The ransomware family, actor and initial access vector were not disclosed, and no ransom payment was officially confirmed.

On July 23, 2025 the Joint Court of Justice (serving Curaçao, Aruba, Sint Maarten, Bonaire, Saba and Sint Eustatius) detected a virus in its IT system and shut down its entire network as a precaution, suspending court operations for several days. The Parliament of Aruba separately reported a compromised email account, with email communications affected between July 23 and 28. The Record also notes that on July 22 the Netherlands' Public Prosecution Service alerted to a Citrix NetScaler vulnerability; no source ties that vulnerability to the Caribbean incidents, so no CVE is assigned here. Attribution is unknown. Severity MEDIUM is an analyst judgement from incident impact, not a source-stated score.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1114 Email Collection
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship

## Sources

- [Why Caribbean Threats Cascade Into Global Cyber-Risk](https://www.darkreading.com/cyber-risk/why-caribbean-threats-cascade-global-cyber-risk)
- [Dutch Caribbean islands respond to cyberattacks on courts, tax departments (The Record)](https://therecord.media/aruba-curacao-governments-cyberattacks)
- [Ransomware attack cripples Curaçao tax office, Dutch cybersecurity experts called in (Curaçao Chronicle)](https://www.curacaochronicle.com/post/local/ransomware-attack-cripples-curacao-tax-office-dutch-cybersecurity-experts-called-in/)
- [Belastingdienst Curaçao weer open na aanval met ransomware (TaxLive)](https://www.taxlive.nl/nl/documenten/nieuws/belastingdienst-curacao-weer-open-na-aanval-met-ransomware/)
- [NL Times coverage of Dutch Caribbean cyber incidents](https://nltimes.nl/node/82197)
- [Partial services resume at Curaçao tax office after ransomware attack (Curaçao Chronicle)](https://www.curacaochronicle.com/post/local/partial-services-resume-at-curacao-tax-office-after-ransomware-attack)
- [Joint Court of Justice provides update on network outage, data remains secure (Curaçao Chronicle)](https://www.curacaochronicle.com/post/local/joint-court-of-justice-provides-update-on-network-outage-data-remains-secure)
- [Malware forces Dutch Caribbean courts offline, highlighting growing cyber risks (Curaçao Chronicle)](https://www.curacaochronicle.com/post/local/malware-forces-dutch-caribbean-courts-offline-highlighting-growing-cyber-risks)
- [Netherlands: Citrix NetScaler flaw CVE-2025-6543 exploited to breach orgs (BleepingComputer)](https://www.bleepingcomputer.com/news/security/netherlands-citrix-netscaler-flaw-cve-2025-6543-exploited-to-breach-orgs/)
- [Dutch NCSC confirms active exploitation (The Hacker News)](https://thehackernews.com/2025/08/dutch-ncsc-confirms-active-exploitation.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4272