Saudi Press

Saudi Arabia and the world
Monday, Jan 26, 2026

President Rodrigo Chaves says Costa Rica is at war with Conti hackers

President Rodrigo Chaves says Costa Rica is at war with Conti hackers

The president of Costa Rica says his country is "at war", as cyber-criminals cause major disruption to IT systems of numerous government ministries.

Rodrigo Chaves said hackers infiltrated 27 government institutions, including municipalities and state-run utilities.

The Conti ransomware cartel, which is thought to be run from Russia, has upped its ransom demand to $20m (£16m).

The criminals posted an appeal online to Costa Ricans to "go out on the street and demand payment".

Mr Chaves held a press conference on Monday to outline his "Plan for Implementation of Cyber-security Measures".

He gave no indication that he was planning on paying the ransom, in spite of growing disruption to government departments.

On Wednesday, the Costa Rican Treasury told civil servants that the hack had affected automatic payment services. It warned that they would not be paid on time, and would need to apply for their salaries by email, or on paper by hand.

The ministry said: "Due to the temporary downturn of the institutional systems, the service of issuing certificates regarding the amounts of salaries owed to the civil servants of the Central Administration is suspended.

"All applications received via email or in the windows of the National Accountancy will be attended to once systems are restored."

According to the government, the attacks also affected the country's foreign trade by hitting its tax and customs systems.

Mr Chaves launches his Plan for Implementation of Cyber-security Measures in response to the hack


The president, who was elected fewer than two weeks ago, declared the incident a "national emergency" and has repeatedly blamed his predecessor for not taking the cyber-attack seriously enough.

The hackers were demanding $10m when the attack started last month.

A government website says that a declaration of a state of emergency allows it, in exceptional cases, to undertake on its own some procedures that would normally require legislative approval.

For example, it allows the government to allocate public funds to deal with an emergency, without previous legislative consent.

"The attack being experienced by Costa Rica at the hands of cyber-criminals, cyber-terrorists, is declared a national emergency," Mr Chavez said, according to local media.

"We are signing this decree, precisely, to declare a state of national emergency across the entire public sector of the Costa Rican state, and allow our society to respond to those attacks as criminal actions."

The Conti hacking group has posted more than 600 gigabytes of government data online, and is threatening to publish more.

It has also posted on its darknet website that it will delete the decryption keys needed to restore the government's computer systems to normality, unless it is paid within a week.

"There is less than a week left when we destroy your keys, we are also working on gaining access to your other systems, you have no other options but to pay us," it threatened.


On its darknet website, Conti writes to the Costa Rican government: "You're forcing us to use terrible methods..."

And "terrible" is the word many cyber-security researchers are using to describe these new tactics the hackers are using to put pressure on the Costa Rican government to pay.

In the past, ransomware crews have attacked public bodies and local governments, but it is rare to see such a disruptive attack on a state.

It's also unprecedented to see such aggressive threats and direct appeals to Costa Ricans to "take to the streets".

The hackers also claim to have operatives on the inside of government - which may be unlikely but further piles the pressure on the president.

In some ways it all reads like desperation.

Conti has probably put a lot of work into its attack and it looks like it may come away empty-handed.

But it is also another terrible reminder of the power criminal hackers can wield, even against governments.

Conti is a prolific Russian speaking ransomware group responsible for many high-profile hacks.

In May 2021, the group carried out a "catastrophic hack" of the Irish Health Service.

On 6 May, the US offered a $10m reward for information about the group's leadership.

It blamed Conti for the cyber-attacks which hit Costa Rica.


Cyber-security researcher Maya Horowitz, of Check Point, says Costa Rica is not the only country to be targeted by criminals, who may be put off US organisations because of pressure from the authorities there.

"Recently we have seen two massive ransomware attacks in Costa Rica and Peru, both reportedly executed by the infamous Conti ransomware gang.

"Based on our latest research, Conti's extortion planning is very focused and based on the ability of the victim to pay," she added.

Mrs Horowitz said the research also suggested that the financial impact of a ransomware attack is "seven times higher than the initial extortion demand, but we assume in the case of a wide attack on a government like we see here, the total costs will be considerably more".


Watch: What is ransomware and how does it work?


Newsletter

Related Articles

Saudi Press
0:00
0:00
Close
Trump Defends Saudi Crown Prince in Heated Exchange After Reporter Questions Khashoggi Murder and 9/11 Links
Saudi Stocks Rally as Kingdom Prepares to Fully Open Capital Market to Global Investors
Air France and KLM Suspend Multiple Middle East Routes as Regional Tensions Disrupt Aviation
Saudi Arabia scales back Neom as The Line is redesigned and Trojena downsized
Saudi Industrial Group Completes One Point Three Billion Dollar Acquisition of South Africa’s Barloworld
Saudi-Backed LIV Golf Confirms Return to Trump National Bedminster for 2026 Season
Gold Jumps More Than 8% in a Week as the Dollar Slides Amid Greenland Tariff Dispute
Boston Dynamics Atlas humanoid robot and LG CLOiD home robot: the platform lock-in fight to control Physical AI
United States under President Donald Trump completes withdrawal from the World Health Organization: health sovereignty versus global outbreak early-warning access
Trump Administration’s Iran Military Buildup and Sanctions Campaign Puts Deterrence Credibility on the Line
Tech Brief: AI Compute, Chips, and Platform Power Moves Driving Today’s Market Narrative
NATO’s Stress Test Under Trump: Alliance Credibility, Burden-Sharing, and the Fight Over Strategic Territory
Saudi Arabia’s Careful Balancing Act in Relations with Israel Amid Regional and Domestic Pressures
Greenland, Gaza, and Global Leverage: Today’s 10 Power Stories Shaping Markets and Security
America’s Venezuela Oil Grip Meets China’s Demand: Market Power, Legal Shockwaves, and the New Rules of Energy Leverage
Trump’s Board of Peace: Breakthrough Diplomacy or a Hostile Takeover of Global Order?
Prince William to Make Official Visit to Saudi Arabia in February
Saudi Arabia Advances Ambitious Artificial River Mega-Project to Transform Water Security
Saudi Crown Prince and Syrian President Discuss Stabilisation, Reconstruction and Regional Ties in Riyadh Talks
Mohammed bin Salman Confronts the ‘Iranian Moment’ as Saudi Leadership Faces Regional Test
Cybercrime, Inc.: When Crime Becomes an Economy. How the World Accidentally Built a Twenty-Trillion-Dollar Criminal Economy
Strategic Restraint, Credible Force, and the Discipline of Power
Donald Trump Organization Unveils Championship Golf Course and Luxury Resort Project in Saudi Arabia
Inside Diriyah: Saudi Arabia’s $63.2 Billion Vision to Transform Its Historic Heart into a Global Tourism Powerhouse
Trump Designates Saudi Arabia a Major Non-NATO Ally, Elevating US–Riyadh Defense Partnership
Trump Organization Deepens Saudi Property Focus with $10 Billion Luxury Developments
There is no sovereign immunity for poisoning millions with drugs.
Mohammed bin Salman’s Global Standing: Strategic Partner in Transition Amid Debate Over His Role
Saudi Arabia Opens Property Market to Foreign Buyers in Landmark Reform
The U.S. State Department’s account in Persian: “President Trump is a man of action. If you didn’t know it until now, now you do—do not play games with President Trump.”
CNN’s Ranking of Israel’s Women’s Rights Sparks Debate After Misleading Global Index Comparison
Saudi Arabia’s Shifting Regional Alignment Raises Strategic Concerns in Jerusalem
OPEC+ Holds Oil Output Steady Amid Member Tensions and Market Oversupply
Iranian Protests Intensify as Another Revolutionary Guard Member Is Killed and Khamenei Blames the West
President Trump Says United States Will Administer Venezuela Until a Secure Leadership Transition
Delta Force Identified as Unit Behind U.S. Operation That Captured Venezuela’s President
Trump Announces U.S. Large-Scale Strike on Venezuela, Declares President Maduro and Wife Captured
Saudi-UAE Rift Adds Complexity to Middle East Diplomacy as Trump Signals Firm Leadership
OPEC+ to Keep Oil Output Policy Unchanged Despite Saudi-UAE Tensions Over Yemen
Saudi Arabia and UAE at Odds in Yemen Conflict as Southern Offensive Deepens Gulf Rift
Abu Dhabi ‘Capital of Capital’: How Abu Dhabi Rose as a Sovereign Wealth Power
Diamonds Are Powering a New Quantum Revolution
Trump Threatens Strikes Against Iran if Nuclear Programme Is Restarted
Why Saudi Arabia May Recalibrate Its US Spending Commitments Amid Rising China–America Rivalry
Riyadh Air’s First Boeing 787-9 Dreamliner Completes Initial Test Flight, Advancing Saudi Carrier’s Launch
Saudi Arabia’s 2025: A Pivotal Year of Global Engagement and Domestic Transformation
Saudi Arabia to Introduce Sugar-Content Based Tax on Sweetened Drinks from January 2026
Saudi Hotels Prepare for New Hospitality Roles as Alcohol Curbs Ease
Global Airports Forum Highlights Saudi Arabia’s Emergence as a Leading Aviation Powerhouse
Saudi Arabia Weighs Strategic Choice on Iran Amid Regional Turbulence
×