Costa Rica ransomware attack (2022)

Date 	The first wave of ransomware attacks started on 17 April 2022.Associated Press, ‘Costa Rica, 'under assault' is a troubling test case on ransomware attacks’ (NBC News, 17 June 2022). The second one was launched on 31 May 2022.Tweet of the Costa Rican Social Security Fund of 31 May 2022 (confirming that the CCSS had been hacked in the morning of 31 May 2022).
Suspected actor	The alleged perpetrator of the first wave of attacks is the ‘Conti’ Group, while the second one is believed to have been conducted by the ‘Hive’ Group.Christine Murry & Mehul Srivastava, ‘How Conti ransomware group crippled Costa Rica — then fell apart’, (Financial Times, 9 July 2022); Viswanatha & Dustin Volz, ‘FBI Disrupts ‘Hive’ Ransomware Group’ (Wall Street Journal, 26 January 2023). Both groups are reportedly based in the Russian Federation.Joe Tidy, ‘Seven Russians sanctioned over ransomware cyber-crime’ (BBC News, 9 February 2023); Aruna Viswanatha & Dustin Volz, ‘FBI Disrupts ‘Hive’ Ransomware Group’ (Wall Street Journal, 26 January 2023).
Victims 	27 different public institutions of Costa Rica were targeted, including its Ministry of Finance, the Ministry of Science, Innovation, Technology and Telecommunications (MICITT), the National Meteorological Institute (IMN), the Costa Rican Social Security Fund and the Ministry of Labor and Social Security (MTSS).Christine Murry & Mehul Srivastava, ‘How Conti ransomware group crippled Costa Rica — then fell apart’, (Financial Times, 9 July 2022).
Target systems 	Microsoft-based servers operated by the Costa Rican government.Pratim Milton Datta & Thomas Acton, ‘Ransomware and Costa Rica’s National Emergency: A Defense Framework and Teaching Case’  (2023) Journal of Information Technology Teaching Cases 1.
Method 	The first attack was directed at the servers of the Costa Rican Ministry of Finance, disabling the Virtual Tax Administration (ATV) and the Customs Information System (TICA). Two days later, the website of the Ministry of Science, Innovation, Technology and Telecommunications was defaced. Hours later, Conti attacked an email server of the National Meteorological Institute stealing the information therein.Christine Murry & Mehul Srivastava, ‘How Conti ransomware group crippled Costa Rica — then fell apart’, (Financial Times, 9 July 2022).
The Hive Group carried out its attack against the Costa Rican Social Security Fund (CCSS) by forcing the institution to shut down all its critical systems, including the Single Digital Health Record (EDUS) and the Centralized Collection System (SICERE).Twitter thread of the Costa Rican Ministry of Finance of 19 April 2022 (announcing that, due to the shutdown of the systems, the deadline for filing taxes would be postponed).
Purpose 	The Conti Group, which claimed responsibility for the first group of attacks, demanded a US $20 million ransom in exchange for not releasing information stolen from the Ministry of Finance, including citizens’ tax returns and sensitive information about companies operating in Costa Rica.Associated Press, ‘Costa Rica, 'under assault' is a troubling test case on ransomware attacks’ (NBC News, 17 June 2022).
The Hive Group allegedly requested a payment of US $5 million in bitcoin, after which it would restore the operations of the Costa Rican Social Security Fund.Pratim Milton Datta & Thomas Acton, ‘Ransomware and Costa Rica’s National Emergency: A Defense Framework and Teaching Case’  (2023) Journal of Information Technology Teaching Cases 1.
Result 	The government refused to pay the hackers which it labelled “terrorist groups”.Joe Tidy, ‘President Rodrigo Chaves says Costa Rica is at war with Conti hackers’ (BBC, 18 May 2022). As a result, the effects of the attack continued for several months until the end of June 2022.Associated Press, ‘Costa Rica, 'under assault' is a troubling test case on ransomware attacks’ (NBC News, 17 June 2022). During this time, the government was forced to temporarily shut down the computer systems used to declare taxes and for the control and management of imports and exports, causing an economic loss of about US$ 125 million in the first 48 hours following the attack.Chamber of Foreign Trade of Costa Rica, ‘$125 millones en pérdidas estima Cámara de Comercio Exterior tras ciberataque que afectó aduanas’ (Facebook post, 19 April 2022). Furthermore, teachers were unable to get paychecks, tax and customs systems were paralyzed and health officials were unable to access medical records.Associated Press, ‘Costa Rica, 'under assault' is a troubling test case on ransomware attacks’ (NBC, 17 June 2022). On 8 May 2022, the president of Costa Rica issued an executive order proclaiming a national emergency due to the cyberattacks against the country’s public sector and stated that the country was in a “state of war”.Kevin Collier, ‘Costa Rica declares state of emergency over ransomware attack’ (NBC, 11 May 2022).
Aftermath 	After the declaration of a national emergency, unions negotiated with the government to ensure that workers would be paid despite the shutdown of social security systems.Office of the President of Costa Rica, ‘Conferencia de prensa del sector educativo - 21 de mayo 2022’ (Facebook, 21 May 2022) (confirming that the government has signed an agreement to advance the payment of the 3'160 teachers who were unable to receive paychecks due to the shutdown of the systems). The role of the United States in protecting ‘friendly nations’ from cyberattacks was also debated.Alan Suderman & Ben Fox, ‘Costa Rica chaos a warning that ransomware threat remains’ (AP News, 17 June 2022). The Costa Rican government received technical assistance from Microsoft as well as the governments of the United States, Israel and Spain in order to restore its services.Pratim Milton Datta & Thomas Acton, ‘Ransomware and Costa Rica’s National Emergency: A Defense Framework and Teaching Case’  (2023) Journal of Information Technology Teaching Cases 1. The US State department offered a US$10 million reward for information leading to the identification of persons in a leadership position within the Conti Group.US State Department, ‘Reward Offers for Information to Bring Conti Ransomware Variant Co-Conspirators to Justice’ (6 May 2022). The Hive Group was effectively shut down in January 2023 following a coordinated effort by Europol and the German, Dutch and US authorities.Europol, ‘Cybercriminals stung as HIVE infrastructure shut down’ (26 January 2023).
Analysed in 	Scenario 14: Ransomware campaign
Scenario 20: Cyber operations against medical facilities
Collected by: Yannick Zerbe
Category:Example
Category:2022
Category:Ransomware