Arab Press

بالشعب و للشعب
Tuesday, Mar 17, 2026

President Rodrigo Chaves says Costa Rica is at war with Conti hackers

President Rodrigo Chaves says Costa Rica is at war with Conti hackers

The president of Costa Rica says his country is "at war", as cyber-criminals cause major disruption to IT systems of numerous government ministries.

Rodrigo Chaves said hackers infiltrated 27 government institutions, including municipalities and state-run utilities.

The Conti ransomware cartel, which is thought to be run from Russia, has upped its ransom demand to $20m (£16m).

The criminals posted an appeal online to Costa Ricans to "go out on the street and demand payment".

Mr Chaves held a press conference on Monday to outline his "Plan for Implementation of Cyber-security Measures".

He gave no indication that he was planning on paying the ransom, in spite of growing disruption to government departments.

On Wednesday, the Costa Rican Treasury told civil servants that the hack had affected automatic payment services. It warned that they would not be paid on time, and would need to apply for their salaries by email, or on paper by hand.

The ministry said: "Due to the temporary downturn of the institutional systems, the service of issuing certificates regarding the amounts of salaries owed to the civil servants of the Central Administration is suspended.

"All applications received via email or in the windows of the National Accountancy will be attended to once systems are restored."

According to the government, the attacks also affected the country's foreign trade by hitting its tax and customs systems.

Mr Chaves launches his Plan for Implementation of Cyber-security Measures in response to the hack


The president, who was elected fewer than two weeks ago, declared the incident a "national emergency" and has repeatedly blamed his predecessor for not taking the cyber-attack seriously enough.

The hackers were demanding $10m when the attack started last month.

A government website says that a declaration of a state of emergency allows it, in exceptional cases, to undertake on its own some procedures that would normally require legislative approval.

For example, it allows the government to allocate public funds to deal with an emergency, without previous legislative consent.

"The attack being experienced by Costa Rica at the hands of cyber-criminals, cyber-terrorists, is declared a national emergency," Mr Chavez said, according to local media.

"We are signing this decree, precisely, to declare a state of national emergency across the entire public sector of the Costa Rican state, and allow our society to respond to those attacks as criminal actions."

The Conti hacking group has posted more than 600 gigabytes of government data online, and is threatening to publish more.

It has also posted on its darknet website that it will delete the decryption keys needed to restore the government's computer systems to normality, unless it is paid within a week.

"There is less than a week left when we destroy your keys, we are also working on gaining access to your other systems, you have no other options but to pay us," it threatened.


On its darknet website, Conti writes to the Costa Rican government: "You're forcing us to use terrible methods..."

And "terrible" is the word many cyber-security researchers are using to describe these new tactics the hackers are using to put pressure on the Costa Rican government to pay.

In the past, ransomware crews have attacked public bodies and local governments, but it is rare to see such a disruptive attack on a state.

It's also unprecedented to see such aggressive threats and direct appeals to Costa Ricans to "take to the streets".

The hackers also claim to have operatives on the inside of government - which may be unlikely but further piles the pressure on the president.

In some ways it all reads like desperation.

Conti has probably put a lot of work into its attack and it looks like it may come away empty-handed.

But it is also another terrible reminder of the power criminal hackers can wield, even against governments.

Conti is a prolific Russian speaking ransomware group responsible for many high-profile hacks.

In May 2021, the group carried out a "catastrophic hack" of the Irish Health Service.

On 6 May, the US offered a $10m reward for information about the group's leadership.

It blamed Conti for the cyber-attacks which hit Costa Rica.


Cyber-security researcher Maya Horowitz, of Check Point, says Costa Rica is not the only country to be targeted by criminals, who may be put off US organisations because of pressure from the authorities there.

"Recently we have seen two massive ransomware attacks in Costa Rica and Peru, both reportedly executed by the infamous Conti ransomware gang.

"Based on our latest research, Conti's extortion planning is very focused and based on the ability of the victim to pay," she added.

Mrs Horowitz said the research also suggested that the financial impact of a ransomware attack is "seven times higher than the initial extortion demand, but we assume in the case of a wide attack on a government like we see here, the total costs will be considerably more".


Watch: What is ransomware and how does it work?


Newsletter

Related Articles

Arab Press
0:00
0:00
Close
Saudi Arabia Targets South African Professionals in New Recruitment Drive Amid Regional Uncertainty
Formula One Faces Major Financial Hit as Bahrain and Saudi Arabian Grands Prix Cancelled Amid Middle East Conflict
U.S. and Saudi Firms Launch Local Production of Attritable Drone Systems in Saudi Arabia
Saudi Arabia and UAE Warn Rising Gulf Tensions Could Endanger Regional Security
Saudi Arabia Rejects Claims It Encouraged Prolonged War With Iran
Saudi Arabia to Host World’s Largest Single-Cell Protein Plant as Food Security Push Accelerates
Saudi Crown Prince Urges Trump to Continue Military Pressure on Iran
Iran Intensifies Drone Campaign Against Saudi Arabia as Gulf Conflict Escalates
When Is Eid al-Fitr 2026? Saudi Arabia Awaits Moon Sighting to Confirm End of Ramadan
When Is Eid al-Fitr 2026? Saudi Arabia Awaits Moon Sighting to Confirm End of Ramadan
Iranian Missile Strike Damages Five U.S. Refueling Aircraft at Saudi Air Base
Iranian Missile Strike Damages Five U.S. Refueling Aircraft at Saudi Air Base
Washington State Pilot Among Six U.S. Airmen Killed in Military Aircraft Crash Over Iraq
Severe Storm Threat Looms Over Washington as Tornado Risk and Damaging Winds Target Mid-Atlantic
Trump Supports FCC Warning to Broadcasters Over Iran War Reporting
Trump Supports FCC Warning to Broadcasters Over Iran War Reporting
Saudi Stocks Edge Lower as Tadawul All Share Index Slips Slightly at Market Close
Iranian Missile and Drone Strike Targets Saudi Arabia’s Prince Sultan Air Base Hosting US Aircraft
Saudi Air Defenses Intercept Drone Over Eastern Province as Iranian Strike Campaign Intensifies
Middle East War Reshapes Gulf Economies as Saudi Arabia and Oman Gain Strategic Leverage While UAE Faces Economic Shock
Iranian Ambassador in Riyadh Blames ‘Enemies’ for Attacks Across the Gulf
Israeli Envoy Ron Dermer Reportedly Visits Saudi Arabia for Discussions on Potential Lebanon Talks
Formula One Cancels Bahrain and Saudi Arabian Grands Prix Scheduled for April
Iran’s Ambassador in Riyadh Rejects Claims Tehran Targeted Saudi Oil Facilities
Saudi Arabia Declares 2026 ‘Year of Artificial Intelligence’ in Major Push for Data-Driven Economy
Saudi Arabia’s 2018 Budget Signals Strong Push for Non-Oil Economic Growth
Pakistan Envoy in Riyadh Says Regional Diplomacy Intensifying to Prevent Wider Middle East War
Saudi Arabia Intercepts Dozens of Drones as Regional Strikes Kill Two in Oman
Saudi Arabia Redirects Oil Exports to Red Sea Ports as Strait of Hormuz Tensions Escalate
Saudi Arabia Intercepts Missile and Drone Barrage as Regional Conflict Intensifies
Iran Expands Drone and Missile Campaign Across Gulf as Conflict With US and Israel Intensifies
Muslims Worldwide Await Saudi Moon Sighting to Confirm Eid al-Fitr 2026 Date
F1 Calendar Faces Major Disruption as Middle East Conflict Threatens Bahrain and Saudi Races
Trump Says Most US Aircraft Hit in Saudi Base Attack Suffered Minimal Damage
Trump Says Most US Aircraft Hit in Saudi Base Attack Suffered Minimal Damage
Strait of Hormuz Crisis Forces Saudi Arabia Into Major Oil Production Shut-In
Strait of Hormuz Crisis Forces Saudi Arabia Into Major Oil Production Shut-In
Saudi Arabia Slashes Oil Output as Strait of Hormuz Crisis Cuts Deep Into Gulf Revenues
Saudi Arabia’s Cultural Scene Presses Ahead as Nation Navigates Regional War
Saudi-Pakistan Defence Pact Faces Real-World Constraints as Iran War Escalates
Saudi Arabia Offers Two Million Barrels of Crude From Red Sea as War Disrupts Gulf Exports
Formula One Faces Tens of Millions in Lost Revenue if Bahrain and Saudi Arabia Races Are Cancelled
Formula One Set to Cancel Bahrain and Saudi Arabian Grands Prix Amid Escalating Middle East War
Saudi Arabia Downs Dozens of Iranian Drones in Major Defensive Operation
Saudi Arabia Cuts Oil Output by About Twenty Percent as Iran War Disrupts Gulf Energy Flows
Formula One Set to Cancel Bahrain and Saudi Arabian Grands Prix Amid Escalating Iran War
Asian Energy Security Tested as Strait of Hormuz Disruption Threatens Oil Supplies
Iran Sets Three Conditions for Ending Regional War as Diplomatic Efforts Intensify
Saudi Arabia Launches Royal Institute of Anthropology to Examine Social Transformation
Pakistan’s Prime Minister Shehbaz Sharif Arrives in Saudi Arabia for High-Level Talks
×