Costa Rica declares state of emergency following Conti ransomware attack
The US has released a $10 million bug bounty for information on the attackers


The newly-inaugurated president of Costa Rica, Rodrigo Chaves Robles, reportedly declared a state of emergency on Sunday after the country’s government had been hit by Conti ransomware last month.
This is one of the first executive decrees the president has signed, after beginning his presidency on 8 May, as reported by journalist Amelia Rueda. It mandates the need for Costa Rica to invest in cyber security and respond to the ongoing attack.
The first entity to be hit was the Treasury on 18 April, although the full impact of the ransomware is still unknown. It has been without any kind of digital services, meaning that its processes have been forced to be completed manually.
On 6 May, the US Department of State also posted a $10 million bounty for information leading to the identification or location of any individuals who hold a key leadership position in the Conti ransomware group. The department is also offering a reward of $5 million for information leading to the arrest and/or conviction of any individual in any country conspiring to participate in a Conti ransomware incident. It underlined that the group attacked Costa Rica in April, impacting the country’s foreign trade by disrupting its customs and taxes platforms.
“We’ve signed the decree so the country can defend against the criminal attack that cyber criminals are carrying out,” added Chaves. “This is an assault on the nation and we have signed this decree to help us defend ourselves better.”
Conti has released a statement about the attack online where it said Costa Rica could have avoided this by paying a $10 million ransom, as reported by CyberScoop. The post also indicated that around 97% of the stolen data has been published so far, with around 672GB of information taken.
“You also need to know that no organised team was created for this attack, no government of other countries has finalised this attack, everything was carried out by me with a successful affiliate, my name is unc1756,” stated the message. “The purpose of this attack was to earn money, in the future I will definitely carry out attacks of a more serious format with a larger team, Costa Rica is a demo version.”
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The message contained links to four Costa Rican websites: the Treasury, the Ministry of Work and Social Security, the Social Development and Family Allowances Fund, and SIUA, a local university.
RELATED RESOURCE
The Total Economic Impact™ of Mimecast
Cost savings and business benefits enabled by using Mimecast with Microsoft 365
FREE DOWNLOAD
"With cyberattacks on government and critical infrastructure organisations on the rise, we’re starting to see the very real and devastating consequences of cybercrime brought to life," said Christiaan Beek, lead scientist and senior principal engineer of Trellix Threat Labs. "Not only does the threat of this type of double extortion ransomware have major cost and data privacy implications, but the ongoing disruption to crucial operations such as utilities can impact human life. Malicious actors are using this attack technique as powerful leverage over governments for financial gain. Yet even in cases where the ransom is paid, significant resource will be needed to rebuild systems and processes, as well as manage the long-term consequences of stolen files being shared on the dark web."
In February, a Ukrainian cyber researcher unveiled data belonging to the Conti ransomware gang. The researcher had access to the group’s systems and released the data after the gang declared its support for Russia following the invasion of Ukraine. It includes Bitcoin addresses, chat logs, and negotiations between ransomware victims and Conti attackers.
Zach Marzouk is a former ITPro, CloudPro, and ChannelPro staff writer, covering topics like security, privacy, worker rights, and startups, primarily in the Asia Pacific and the US regions. Zach joined ITPro in 2017 where he was introduced to the world of B2B technology as a junior staff writer, before he returned to Argentina in 2018, working in communications and as a copywriter. In 2021, he made his way back to ITPro as a staff writer during the pandemic, before joining the world of freelance in 2022.
-
How to implement a four-day week in tech
In-depth More companies are switching to a four-day week as they look to balance employee well-being with productivity
-
Intelligence sharing: The boost for businesses
In-depth Intelligence sharing with peers is essential if critical sectors are to be protected
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
‘All US forces must now assume their networks are compromised’ after Salt Typhoon breach
News The announcement marks the second major Salt Typhoon incident in the space of two years
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making