Costa Rica‘s newly inaugurated president, Rodrigo Chaves, declared a national emergency after the Conti ransomware gang attacked multiple government ministries. It was believed to be the first time a country had declared a national emergency in response to a ransomware attack.
What happened
- The attacks began in April 2022 and disrupted the Ministry of Finance, including tax collection and customs systems.
- Conti publicly demanded a ransom, reported at $10m and later $20m, and leaked stolen data when the government refused to pay.
- The US State Department offered rewards of up to $10m for information on Conti’s leaders.
- A separate Hive ransomware attack later hit Costa Rica’s social security fund, disrupting health services.
Why it mattered
The attacks showed that ransomware could disrupt the core functions of a national government, and they turned ransomware into a matter of state security as well as crime. Conti announced it was shutting down its operations in the weeks that followed, although its members were reported to have moved to other groups.
Lessons for organisations
Governments and businesses alike need tested offline backups, network segmentation, and incident response plans that assume key systems may be unavailable for weeks. Public bodies should also agree their position on ransom payments before an incident, rather than deciding under pressure.
Source: BleepingComputer
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
