conti attacks Ministerio de Hacienda - República de Costa Rica

Incident Date:

April 17, 2022

World map

Overview

Title

conti attacks Ministerio de Hacienda - República de Costa Rica

Victim

Ministerio de Hacienda - República de Costa Rica

Attacker

Conti

Location

Catedral, Costa Rica

San Jose, Costa Rica

First Reported

April 17, 2022

Ministerio de Hacienda - República de Costa Rica Suffers Ransomware Attack by Conti Group

Victim Profile

The Ministerio de Hacienda, a pivotal government institution in Costa Rica, oversees the nation's financial affairs, including tax declaration, import/export control, and financial management. While the exact size of the ministry is not detailed, its critical role in managing Costa Rica's financial operations is undeniable.

Vulnerabilities and Impact

The Conti ransomware group, notorious for its aggressive ransomware campaigns, has significantly impacted the Costa Rican government's operations. The attack disrupted critical systems such as the digital tax service and customs control IT systems, leading to estimated losses of $38 million per day for the country's commerce.

Previous Attacks on Costa Rica

In 2022, Costa Rica faced a series of ransomware attacks targeting nearly 30 government institutions, including the Ministry of Finance and the Costa Rican Social Security Fund (CCSS). These incidents caused widespread disruption, necessitating international technical assistance to restore services.

Conti Ransomware Group

The Conti group, a sophisticated criminal organization, has orchestrated hundreds of ransomware incidents since 2020. Utilizing up to 32 individual logical threads, Conti's operations are notably faster and more efficient than many of its counterparts.

Mitigation and Response

In response to the Conti ransomware attack, the Costa Rican government has declared a state of emergency, treating the incident as an act of terrorism. Efforts to mitigate the attack's impact include seeking assistance from international partners and reinforcing cybersecurity measures across government institutions.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.