INCIDENT REPORT · CP-2022-002

Costa Rica government ransomware emergency

L3 · ELEVATEDCONFIRMED

Conti ransomware attacks starting in April 2022 hit multiple Costa Rican government institutions, beginning with the Ministry of Finance. President Rodrigo Chaves declared a national emergency on 8 May 2022.

Incident ID: CP-2022-002
Disclosure date: 18 APR 2022
Detection date: Not publicly documented
Affected countries: Costa Rica
Plotted location: San José, Costa Rica (Affected government institutions (capital))
Threat classification: Level 3 — ELEVATED
Classification rationale: Nationwide disruption of government services leading to a declared state of emergency; held at Level 3 consistent with this project's starting classification.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Government, Healthcare, Finance
Critical infrastructure: Yes
Organizations affected: Ministry of Finance (Hacienda), Ministry of Labor, Costa Rican Social Security Fund (CCSS), Other government institutions
Operational consequences: Government services were disrupted and Conti leaked more than 670 GB of stolen data after Costa Rica refused a $10m ransom demand. On 31 May 2022, Hive ransomware forced the CCSS to shut down its critical systems.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the Costa Rican government to the Conti ransomware group; the separate 31 May CCSS attack was attributed to Hive ransomware

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Costa Rica government ransomware emergency

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2022-002

Disclosure date

18 APR 2022

Detection date

Not publicly documented

Affected countries

Costa Rica

Plotted location

San José, Costa Rica (Affected government institutions (capital))

Threat classification

Level 3 — ELEVATED

Classification rationale

Nationwide disruption of government services leading to a declared state of emergency; held at Level 3 consistent with this project's starting classification.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Government, Healthcare, Finance

Critical infrastructure

Yes

Organizations affected

Ministry of Finance (Hacienda), Ministry of Labor, Costa Rican Social Security Fund (CCSS), Other government institutions

Operational consequences

Government services were disrupted and Conti leaked more than 670 GB of stolen data after Costa Rica refused a $10m ransom demand. On 31 May 2022, Hive ransomware forced the CCSS to shut down its critical systems.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the Costa Rican government to the Conti ransomware group; the separate 31 May CCSS attack was attributed to Hive ransomware