Government · 2022
Costa Rica's national cyber emergency
A country in a state of emergency after a cyberattack.
What happened
In April 2022, Conti ransomware disrupted Costa Rica's Ministry of Finance, taking tax and customs platforms offline. More public institutions reported effects, government payments were delayed and foreign trade had to operate through emergency procedures. On May 8, the government declared a national emergency because of the cyberattacks. A separate Hive ransomware incident later disrupted the social-security and healthcare system.
Threat-intelligence researchers reconstructed the first intrusion as the use of stolen credentials through the Ministry of Finance's VPN. The attackers then moved through servers, deployed Cobalt Strike and removed hundreds of gigabytes of data before beginning public extortion. A legislator estimated the economic damage at $30M per day. The incident demonstrated how one compromised identity could disrupt essential services far beyond a single ministry.
What would have changed it
A national service needs identity controls and an offline operating plan. We harden remote access, monitor credential use and test how essential services continue during containment.