The Telecom­mu­ni­ca­tions Ser­vices of Trinidad and To­ba­go (TSTT) board yes­ter­day fired CEO Lisa Agard in the wake of the re­cent cy­ber­at­tack on the state-owned com­pa­ny.

Guardian Me­dia un­der­stands the board took the de­ci­sion yes­ter­day af­ter re­ceiv­ing ad­vice from se­nior coun­sel. The board sub­se­quent­ly com­mu­ni­cat­ed to Agard that it had lost con­fi­dence in her based on how the com­pa­ny re­spond­ed to and han­dled the Oc­to­ber 9 cy­ber­at­tack.

Con­tact­ed on the de­ci­sion, TSTT chair­man Sean Roach said, “It is not our pol­i­cy to dis­cuss any mat­ter in­volv­ing com­pa­ny per­son­nel pub­licly. I can, how­ev­er, say that the for­mer CEO’s de­par­ture was in ac­cor­dance with the terms and con­di­tions of her con­tract. As chair­man of the board of TSTT, I would like to wish her well in all her fu­ture en­deav­ours.”

In a state­ment yes­ter­day, the TSTT board an­nounced the ap­point­ment of Kent West­ern as CEO ef­fec­tive im­me­di­ate­ly. Pri­or to his ap­point­ment, West­ern was TSTT’s gen­er­al man­ag­er, Cus­tomer Ex­pe­ri­ence and Mar­ket­ing.

The cy­ber breach on TSTT was on­ly made pub­lic on Oc­to­ber 27, af­ter Fal­con Feeds, an In­dia-based tech­nol­o­gy se­cu­ri­ty com­pa­ny, re­port­ed on its X so­cial me­dia ac­count that ran­somware group, Ran­somExx, had added TSTT (http://tstt.co.tt) to its vic­tim list. It claimed to have ac­cess to 6GB of or­gan­i­sa­tion da­ta.

Agard, an at­tor­ney with over 23 years’ ex­pe­ri­ence in the telecom­mu­ni­ca­tions in­dus­try, was ap­point­ed TSTT CEO on May 24, 2021. At the time of her ap­point­ment, the com­pa­ny not­ed she was the first woman to be con­firmed in the lead­er­ship role of the on­ly na­tion­al com­mu­ni­ca­tions so­lu­tion provider. Agard had been TSTT’s act­ing CEO since Sep­tem­ber 23, 2020.

Among her ca­reer hats, Agard was Am­plia Com­mu­ni­ca­tions Lim­it­ed gen­er­al man­ag­er and a for­mer Guardian Me­dia man­ag­ing di­rec­tor.

Union feels vin­di­cat­ed

Mean­while, Com­mu­ni­ca­tions Work­ers’ Union sec­re­tary gen­er­al Clyde El­der yes­ter­day said the union felt vin­di­cat­ed by the board’s ac­tion, not­ing it was a step in the right di­rec­tion.

“We have been call­ing for this,” he said.

How­ev­er, he said Agard was not sole­ly re­spon­si­ble for the re­sponse to the da­ta leak and called for the re­moval of Chief Fi­nan­cial Of­fi­cer Shi­va Ram­nar­ine as well.

“He did not pay for prop­er cy­ber se­cu­ri­ty ser­vices for the com­pa­ny, which would have min­imised the im­pact and pro­tect­ed cus­tomers,” El­der claimed.

Pub­lic Util­i­ties Min­is­ter Mar­vin Gon­za­les has or­dered an in­de­pen­dent in­ves­ti­ga­tion in­to the da­ta breach. He said the grav­i­ty of the sit­u­a­tion war­rants a thor­ough and full-scale in­ves­ti­ga­tion to as­cer­tain the facts and cir­cum­stances that caused the breach, TSTT’s com­mu­ni­ca­tions re­gard­ing the mat­ter, and the ac­tions the or­gan­i­sa­tion is (and has been) tak­ing to re­duce the pos­si­bil­i­ty of fu­ture cy­ber in­cur­sions.

He said TSTT has to make pub­lic the facts and find­ings, in­so­far as the de­tails do not com­pro­mise cus­tomer con­fi­den­tial­i­ty or fur­ther put at risk the in­tegri­ty of its da­ta or dig­i­tal in­fra­struc­ture.

Guardian Me­dia un­der­stands TSTT has not yet ap­point­ed an in­ves­ti­ga­tor to the mat­ter.

“It will un­fold in two el­e­ments - the in­ter­nal is­sues and the se­cu­ri­ty com­po­nent,” a source ex­plained about the in­ves­ti­ga­tion.

How cy­ber breach un­fold­ed

On Oc­to­ber 28, TSTT said in a state­ment that there was no com­pro­mise of cus­tomer da­ta, but said it had not cor­rob­o­rat­ed in­for­ma­tion in the pub­lic do­main pur­port­ed to be cus­tomer in­for­ma­tion.

Af­ter cy­ber­se­cu­ri­ty ex­perts went dig­ging in­to the da­ta and made their dis­cov­er­ies pub­lic, the com­pa­ny is­sued an­oth­er state­ment on No­vem­ber 3, ad­mit­ting that 6GB, or less than one per cent of the petabytes of the com­pa­ny’s da­ta, was ac­cessed. How­ev­er, it said the ma­jor­i­ty of its cus­tomers’ da­ta was not ac­quired and no pass­words were com­pro­mised.

Last week, at a vir­tu­al in­vestor call pre­sen­ta­tion, Agard apol­o­gised to the com­pa­ny’s cus­tomers and ex­pressed re­gret for the way it han­dled its com­mu­ni­ca­tion fol­low­ing the ­cy­ber­at­tack.

“In our haste to ad­dress the cy­ber prob­lem there were some things that we could have done bet­ter. We were so busi­ly fo­cused on iden­ti­fy­ing the prob­lem, con­tain­ing it and restor­ing full ca­pa­bil­i­ty to serve our cus­tomers that we ne­glect­ed per­haps to com­mu­ni­cate ef­fec­tive­ly with them,” she said.

“The in­for­ma­tion cur­rent­ly in the pub­lic do­main is large­ly per­son­al iden­ti­fi­able in­for­ma­tion which ex­perts have ad­vised us does not pose an el­e­vat­ed risk of fraud­u­lent ac­tiv­i­ty to cus­tomers. We have, of course, ad­vised our cus­tomers to be ex­treme­ly vig­i­lant and on the alert for any sus­pi­cious ac­tiv­i­ty.”

Agard said TSTT has iden­ti­fied two pos­si­ble hy­pothe­ses for the path the threat ac­tors took, but the com­pa­ny was await­ing the com­ple­tion of an in­ves­ti­ga­tion by in­ter­na­tion­al cy­ber­se­cu­ri­ty ex­pert, Check­Point. She said TSTT al­so en­gaged the ser­vices of a lo­cal in­de­pen­dent cy­ber­se­cu­ri­ty com­pa­ny, Cy­ber­Eye, which is af­fil­i­at­ed to Cross­word Cy­ber­se­cu­ri­ty Plc in the Unit­ed King­dom, to do a root cause and log analy­sis, se­cure re-en­able­ment, as­sess the ef­fec­tive­ness of TSTT’s cur­rent cy­ber­se­cu­ri­ty con­trols for pro­tect­ing its in­for­ma­tion as­set against cy­ber threats and, fi­nal­ly, threat mon­i­tor­ing and de­tec­tion.

Guardian Me­dia has re­port­ed that the names of the coun­try’s top of­fi­cials, Prime Min­ster Dr Kei­th Row­ley, Pres­i­dent Chris­tine Kan­ga­loo, Chief Jus­tice Ivor Archie, Fi­nance Min­is­ter Colm Im­bert, Na­tion­al Se­cu­ri­ty Min­is­ter Fitzger­ald Hinds, Po­lice Com­mis­sion­er Er­la Hare­wood-Christo­pher and Pub­lic Util­i­ties Min­is­ter Gon­za­les are all in­clud­ed in a list of peo­ple found in doc­u­ments dumped on the dark web from TSTT’s da­ta breach.

And de­spite de­nial by TSTT, Guardian Me­dia ob­tained scans with cred­it card in­for­ma­tion, as well as bank ac­count num­bers, in­clud­ed in the 6GB da­ta dump. Al­so in­clud­ed among the scans were bank­ing in­for­ma­tion for cus­tomers, com­pa­nies, state en­ter­pris­es and min­istries.

The list con­tains 1.2 mil­lion en­tries.