Overview:
Capital Bank, one of Haiti’s major private-sector banks, has reopened 17 branches and restored interbank transfers after days of disruption, but online banking remains unavailable. The bank has not publicly confirmed a cyberattack, though cybersecurity platforms reported that LockBit 5.0 claimed to target the institution. The incident has renewed concerns about Haiti’s ability to protect critical digital systems and respond to cybercrime.
PORT-AU-PRINCE — Haiti’s Capital Bank has gradually reopened its banking network after several days of disruptions that left customers unable to access services in person and online. Although many branches nationwide have resumed service, online banking remains unavailable for customer transactions.
As of Oct. 19, Capital Bank said it had reopened 17 of its 27 branches nationwide. Transfers through the national interbank electronic payment system, known by its French acronym as SPIH, had also resumed while the bank continued working to restore online services.
“We are also working to restore Capital Bank Online, which remains a priority,” the bank said in a statement on Oct. 18. “We will inform you as soon as it is back in service.”
The issues come amid rumors of a possible cyberattack, though it remains unclear whether the bank’s operational problems are linked to that security incident.
Yet, the disruption has raised broader concerns about Haiti’s vulnerability to cybercrime, particularly when banks and public institutions rely on digital systems whose security and resilience may be difficult to assess. The risks extend beyond financial institutions. A recent International Monetary Fund (IMF) assessment identified major gaps in the interconnection and security governance of government systems used for public finance, tax administration and customs, among other areas managing sensitive information.
A 2025 regional cybersecurity report by the Inter-American Development Bank (IBD) also highlighted weaknesses in Haiti’s national cybersecurity framework and public-sector incident-response capacity. Such gaps can complicate the detection of intrusions, coordination during an attack and the restoration of essential services, the report indicated.
“These findings, however, do not establish the cause of Capital Bank’s disruption,” a senior cybersecurity analyst, who preferred to remain anonymous for fear of being targeted, told The Haitian Times. “But they underscore the consequences a cyber incident could have in a country with limited institutional capacity to respond.”
Reports of a suspected cyberattack
Capital Bank’s service disruption came amid social media reports that the bank had been targeted in a cyberattack.
Hackmanac and BreachSense, two platforms specializing in cybersecurity and cyberthreat intelligence, reported on Oct. 5 that Capital Bank—one of Haiti’s major private banks— was among the organizations LockBit 5.0 claimed to have attacked.
Neither platform confirmed that the alleged attack had succeeded or that an intrusion or data theft had been established. Hackmanac classified the reported attack against Capital Bank as “pending verification,” indicating that the claim had not been fully verified.
🚨Cyber Alert ‼️
🇭🇹Haiti – 𝗖𝗮𝗽𝗶𝘁𝗮𝗹 𝗕𝗮𝗻𝗸
LockBit 5.0 claims to have breached Capital Bank.
Threat actor: LockBit 5.0
Sector: Financial / Insurance
Data exposure (claimed): Not specified
Data type: Not specified
Observed: Oct 5, 2026
Status: Pending… pic.twitter.com/qK62tCwGPC
— Hackmanac (@H4ckmanac) October 5, 2026
In notices issued since Oct. 2, Capital Bank has referred to information technology work affecting its services. On Oct. 4, it announced a “technical incident” that affected access to its application servers and their connection to its core banking system, without mentioning a cyberattack.
On Oct. 6, the bank said local and international partners were working toward a gradual resumption of operations. That same day, however, The Haitian Times learned from a source familiar with the bank’s operations that the institution had suffered a cyberattack.
The source, who spoke anonymously because they were not authorized to speak on the bank’s behalf, said the bank’s director had been negotiating with hackers who demanded a substantial ransom to restore access.
The following day, the bank announced it had delayed its planned gradual reopening. It said the required checks were taking longer than expected.
“Their completion is essential to a secure resumption of activities,” Capital Bank said in Notice No. 4. “Our teams and specialized partners remain fully mobilized. We will soon confirm the date when activities will resume.”
The Haitian Times emailed Capital Bank’s communications department seeking comment on the reported cyberattack but had not received a response.
Although the bank has not publicly confirmed a cyberattack, the confidential source said the incident brought its entire service systems to a halt. Now, it remains unclear what damage was caused or whether customer data was compromised.
The disruption left customers unable to conduct routine transactions. A Capital Bank customer in Cap-Haïtien said he was frustrated because the bank was his primary institution for financial transactions, particularly online. During the outage, he could not access banking services or make SPIH transfers.
He said several friends faced similar problems, including difficulties withdrawing money and using their credit cards.
“I even have a friend who works at Capital Bank. It was me he had to turn to for a loan to cover his expenses,” the customer told The Haitian Times.
Some human resources managers also said their companies couldn’t pay employees, notably those in Haiti’s provinces, who get paid via direct deposit into their Capital Bank accounts.
LockBit 5.0 is a newer version of the LockBit ransomware operation, a cybercrime group that uses a ransomware-as-a-service model to target organizations.
Relaunched in September 2025 after an international law enforcement operation disrupted the group in 2024, LockBit 5.0 can target Windows, Linux and VMware ESXi systems. Its ransomware is designed to encrypt data or disrupt access to it and demand payment to restore access.
Haiti central bank bars financial institutions from negotiating with cybercriminals
The Bank of the Republic of Haiti (BRH), the regulator and supervisor of Haiti’s banking system, addressed the threat of cyberattacks in a statement o on Oct. 20. It said no Haitian financial institution is authorized to negotiate with cybercriminals who demand a ransom.
The BRH said institutions facing such incidents should activate contingency and business continuity plans and strengthen their systems based on findings from forensic investigations.
Financial officials warned that cyberattacks have reached unprecedented levels regionally and globally over the past five years.
Although the other reported incidents do not appear to involve the same ransomware operation or confirmed ransom demands, Haitian banks have faced previous suspected cybersecurity incidents and alleged hacking attempts.
In December 2021, the Banque de l’Union Haïtienne(BUH) faced reports of a cyberattack involving customers’ Mastercard accounts. Customers reported unauthorized transactions, but the origin and full extent of the incident remained unclear.
In February 2022, SOGEBANK experienced major technological disruptions, and some customers reported unauthorized credit card transactions. Haitian media reported suspicions of hacking, but the BRH did not officially confirm a cyberattack. SOGEBANK described the disruption as a technical failure.
“These cyberattacks do not spare Haiti and particularly target its financial system,” the BRH said.
The regulator also stressed that Haiti’s financial sector is subject to rules intended to ensure reliable and secure information systems and minimize cyber risk.
A call to strengthen cybersecurity in Haiti
Capital Bank’s gradual reopening has brought some relief to customers, but the continued outage of its online services highlights the importance of strengthening cybersecurity and preparing institutions to recover from digital attacks.
In a statement posted on X on Oct. 14, Jean Marie Altema, a cybersecurity specialist and former director general of the National Telecommunications Council (CONATEL), said a cyberattack against an entity in a country’s critical sector should be considered a national security threat. He said the incident should prompt the financial sector, the state and the public to learn from the crisis.
“It should serve as a reminder to all other sectors to strengthen their vigilance and cybersecurity capabilities, train personnel, educate customers, and prepare adequately to withstand and respond to evolving threats while ensuring the continuity of their services,” Altema said.
The BRH said it has emphasized stronger information systems since 2023, including through cybersecurity training and awareness efforts, to help preserve financial stability and protect customers’ assets.
Related
