Costa Rica May Be Pawn in Conti Ransomware Group’s Bid to Rebrand, Evade Sanctions
Summary: Costa Rica's national health service, the CCSS, was hit by Hive ransomware on May 31, compromising the Unique Digital Medical File and the National Prescriptions System and forcing medical centers onto paper forms, with the CCSS head confirming Hive was deployed on at least 30 of 1,500 government servers. The attack came weeks after President Rodrigo Chaves declared a state of emergency over a Conti intrusion into the Ministry of Finance, where Conti initially demanded $10 million, doubled it when Costa Rica refused to pay, and leaked more than 670 gigabytes of data on May 20.
Why it matters: ADVIntel assesses that Conti's leaders and affiliates are dispersing into Conti-loyal collectives including AlphV/BlackCat, AvosLocker, BlackByte, HelloKitty, Hive and Karakurt, with Hive the likely biggest beneficiary - so the group your sanctions and payment controls were written against may no longer be the name on the ransom note.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026