Costa Rica declares national emergency amid ransomware attacks
After a month of crippling ransomware attacks, Costa Rica has declared a state of emergency invoking a measure usually reserved to deal with natural disasters or the Covid-19 pandemic to allow the government to react more nimbly to the crisis.
President Rodrigo Chaves, who was sworn in on Sunday, made the emergency declaration one of his first acts. It was published on Wednesday, but Chaves has not named the members of the National Emergency Commission.
The declaration refers to the attack Costa Rica is suffering at the hands of “cybercriminals” and “cyberterrorists”.
The Russian-speaking Conti gang had claimed responsibility for the attack. Last week the US state department offered a $10m reward for information leading to the identification or location of Conti leaders.
The attack began in April when the finance ministry was the first to report that a number of its systems were affected, including tax collection and customs. Attacks also targeted the social security agency’s human resources system and labor ministry.
The Costa Rican government has not reported an expansion of the attack, but some systems, especially at the finance ministry, are still not functioning normally. The government has also not made an estimate of the losses caused by the attack.
Carlos Alvarado was still president when the attacks began and he said Costa Rica would not pay the gang any ransom.
In its statement last week, the US state department said the Conti group had been responsible for hundreds of ransomware incidents during the past two years. “The FBI estimates that as of January 2022, there had been over 1,000 victims of attacks associated with Conti ransomware with victim payouts exceeding $150,000,000, making the Conti Ransomware variant the costliest strain of ransomware ever documented,” the statement said.
In addition to the ransomware state of emergency, Chaves also eliminated pandemic-related obligatory use of masks in public spaces and issued a decree that urged public institutions to not sanction officials who have not been vaccinated against Covid-19, reversing his predecessor’s policy.