BCCAR Reveals How Hackers Breached Its System 

The Belize Companies and Corporate Affairs Registry (BCCAR) has confirmed hackers exploited a flaw in its passport-based registration system to gain unauthorised access to company records in its Online Business Registry System (OBRS).

In its latest and final public update on the cybersecurity incident, BCCAR said its investigation identified the vulnerability in the process used to create limited public user accounts. 

The agency says it has since addressed the vulnerability, strengthened access controls and temporarily disabled passport-based registration for those accounts.

BCCAR has also imposed a temporary limit of 100 document views or downloads per user per hour, reviewed authentication controls and strengthened system logging and monitoring to detect unusual activity earlier.

Documents downloaded during the period of unauthorised access have been identified with what BCCAR describes as “a solid warning icon within OBRS.” 

However, BCCAR did not disclose how many documents or users were affected, nor what categories of company information were exposed. It also did not say if the investigation has identified the culprit(s) and if the breach originated locally or internationally. 

The Online Business Registry System was restored on 10 August, after the cybersecurity incident forced it offline. BCCAR says it is still working with cybersecurity specialists to “independently validate the scope of the incident.”

BCCAR is now pitching prevention over transparency. It pointed to plans for “enhanced continuous monitoring,” including alerts for unusual and bulk activity, periodic access reviews, vulnerability assessments, cybersecurity testing and stronger incident-response procedures.

Customers and Registered Agents are being urged to review their OBRS records.