THE Nassau Container Port’s operator yesterday revealed it has acquired a $1m ownership interest in the entity that controls New Providence’s electricity grid after itself surviving a ransomware attack in April 2024.

BISX-listed Arawak Port Development Company (APD), unveiling its audited financial statements for the 12 months to end-June 2024, disclosed to investors that it acquired 50,000 common or equity shares in Bahamas Grid Company on July 17, 2024.

The purchase was made as part of Bahamas Grid Company’s raising $30m in equity capital from targeted institutional and high net worth investors via private placement, and thus gives APD - which is 20 percent owned by Bahamian shareholders, with the reminder split 40/40 between the Government and shipping industry - a further direct ownership stake in the Government's energy reform drive. 

"On July 17, 2024, after the end of the reporting period, the company acquired 50,000 common shares in Bahamas Grid Company for a total consideration of $1m," APD's 2024 financial statements said. 

“While this transaction occurred after the reporting date, it does not affect the financial position or performance of the company for the year ended June 30, 2024. The acquisition will be recognised in the subsequent fiscal period.”                       

Disclosure of the Bahamas Grid Company interest means that APD now has confirmed equity ownership in two entities at the heart of the Davis administration’s energy reforms. Besides its stake in the company that controls New Providence’s electricity grid, and which is 60 percent majority owned by the private sector, it is also involved in the project to supply shore power to cruise ships docked at Nassau Cruise Port.

Tribune Business previously exclusively revealed that APD, along with Nassau Cruise Port, is part of the Island Power Producers consortium that won the bid to construct a $150m lique ed natural gas (LNG) fuelled power plant that will supply up to 60 megawatts (MW) of power to cruise vessels and those docked at the container port that are able to take shore power.

APD said it was reviewing the questions that Tribune Business posed to it yesterday on both the Bahamas Grid Company investment and the ransomware attack, but no replies were received before press time last night.

The BISX-listed firm said it paid no ransom over the April 2024 intrusion, which resulted in data systems temporarily becoming “inaccessible” and Nassau’s major commercial shipping port having to revert to manual processes to resume operations. It described the disruption as “minimal” and the incident was resolved in just over two weeks.

In an explanation likely to provide a wake-up call to other Bahamian businesses on the perils and risks posed by cyber crime, especially the likes of ransomware, APD’s audited nancial statements said: “On April 18, 2024, the company identified and responded to an Akira ransomware attack, which encrypted certain data systems including those used to record financial data, resulting in servers and on-premises applications being inaccessible for a brief period of time.

“Prompt action was taken to contain the incident and secure the sys- tems, including engaging an external IT service provider to assist with the recovery process and a third party Cyber Incident Response Team (CSIRT) specialist who conducted a forensic investigation of the incident and provided an investigative summary report. Management also notified the Bahamas Computer Incident Response Team (CIRT-BS) and the Royal Bahamas Police Force.

“Management, with the aid of the IT service provider, was able to restore and rebuild the financial data impacting the  nancial statements. The company switched off Internet-facing systems and reverted to a manual process to resume business operations,” APD continued.

“During recovery, back-up files were restored and quarantined. Upon full recovery of systems, electronic records were updated to include the data that could not be recovered and the data captured during the manual operation period. All impacted systems had been successfully restored with minimal disruption to their opera- tions by May 2, 2024.”

Assessing the fall-out, APD added: “Due to the full encryption of nearly every server in the APD environment, lack of available logs and the number of devices/applications in the APD environment with known exploitable vulner- abilities, the third party CSIRT was unable to confirm the root cause of the attack.

“However, the CSIRT investigation found no evidence of data exfitration or significant disruption to operations. The company did not make any ransom payments. The incident did not result in any material financial impact or loss of revenue.

“Management has taken further steps to enhance our cyber security measures and mitigate future risks based on guidance/ recommendations from the CSIRT investigative summary report. This event has been disclosed in accordance with regulatory requirements and international best practices to inform our stakeholders of the potential risks assocated with cyber threats.”

The APD ransomware attack was also probed by the port operator’s external auditors, Pricewaterhouse-Coopers (PwC), as part of the process for verifying accuracy of its 2024 financial statements. The accounting firm informed shareholders that it specifically tested for “accuracy and completeness of transactions” given the nature of the cyber security breach.

Besides gaining an “understanding of management’s processes to monitor and detect security breaches or incidents”, PwC added that it also “assessed the competence and capabilities of the third party service providers used by management in the recovery effort and investigating the incident, and evaluated the appropriateness of the procedures completed”.

And, in addition to testing and reconciling the recovered financial data, as well as verifying manually recorded transactions, PwC said it also evaluated the investigation and report into the ransomware attack to ensure the culprits were no longer able access APD’s systems, detect any accounts that were compromised and ensure that the company’s IT environment was secure moving forward.

Meanwhile, APD’s investment in Bahamas Grid Company appears to be consistent with its recent strategy of making select investments in a bid to diversify revenue streams and seek out higher returns for the $17.769m in cash and cash equivalents held on its balance sheet at year- end June 30, 2024. That represented an increase of more than $1.5m, or 9.7 percent, from the year before’s $16.194m.

Besides a $590,410 investment in the Nassau Cruise Port, via its acquisition of 85,000 shares - valued at $5 apiece - in the Bahamas Investment Fund, which holds a collective 49 percent ownership interest in that venture, APD also acquired two different external, foreign currency Bahamian government bonds when the Central Bank opened a temporary window in late 2022 for local investors to make such purchases.

One bond has already matured, while APD intends to hold the other until its principal is due to be redeemed in November 2028. The value of its holding though, dropped from $4.96m at year-end 2023 to $2.611m just 12 months later - a drop of 47.4 percent year-over-year.

“Interest earned on these bonds is paid semi-annually and booked to interest income in the statement of comprehensive income. During the year ended June 30, 2024, interest earned on these bonds collectively amounted to $286,024 (2023: $223,714),” APD’s financial statements confirmed.

And the Nassau Container Port operator has also been making investments in shorter-term debt securities. “During the year, the company purchased US dollar Treasury Bills (T-Bills), some of which matured before the reporting date. These financial assets are short-term investments with maturities ranging from three to six months,” APD’s  financials said.

“At June 30, 2024, the company held T-Bills with a carrying value of $211,908. These T-bills are classified at amortised cost in accordance with the company’s business model for managing  nancial assets. The maturity date of the remaining T-bills is September 26, 2024. Interest income of $6,102 was recognised during the period and booked in the statement of comprehensive income.”

During the 12 months to end-June 2024, APD made four separate purchases of US treasury bills between October 18, 2023, and June 4, 2024. These purchases collectively totalled $667,000, although several have now matured and the principal repaid.