In a developing cybersecurity incident affecting Belize’s corporate registration infrastructure, the Belize Companies and Corporate Affairs Registry (BCCAR) has pulled its public-facing Online Business Registry System (OBRS) offline after security teams uncovered unauthorized access to stored documents during a scheduled routine maintenance check.
The breach was first detected on Tuesday, August 4, as maintenance teams were conducting standard system updates and security scans. According to an official public statement released by BCCAR this Friday, the unauthorized access was restricted solely to application documents made available through the system’s public information services, with no deeper incursion detected as of the latest update. BCCAR confirmed that while a subset of the accessed documents may hold sensitive, non-public information that could have been viewed or downloaded by unknown actors, the agency acted swiftly to take the full system offline to block any further unauthorized access to the platform.
Preliminary findings from the ongoing investigation have yielded reassuring updates on the overall integrity of BCCAR’s core infrastructure. Investigators have not found any evidence that the underlying OBRS platform, the agency’s central core registry database, core hosting servers, or privileged administrative access accounts were compromised in the incident. Furthermore, there is no indication that any official corporate registry records stored in the system have been amended, deleted, or altered by the unauthorized actors. A key point of relief for users is that no credit card information was put at risk, as the OBRS is not designed to store payment card data on its servers.
In immediate response to the breach, all accounts flagged as suspicious have been permanently disabled to prevent further malicious activity. BCCAR has also brought on external independent cybersecurity specialists to lead the formal investigation, and to conduct a full independent security validation of the entire system before it is brought back online for public use. The agency has announced a tentative timeline for restoring OBRS service, with full access expected to resume as early as Monday.
While the investigation continues, BCCAR has issued an official advisory to all businesses and regular OBRS users urging heightened vigilance against potential follow-up phishing and scam attempts. Users have been warned to monitor all incoming communications closely for suspicious emails, phone calls, or text messages that reference BCCAR, OBRS, or any information previously submitted through the online registry. The agency specifically reminded users to never share passwords, sensitive financial details, or official identity documents in response to unsolicited contact, even if the communication appears to originate from the registry itself.