China has asked Costa Rican authorities to hand over evidence supporting allegations that Chinese-linked actors were behind a cyberespionage attack on the Costa Rican Electricity Institute, opening a new point of tension in the already strained relationship between San José and Beijing. The request was made publicly Friday by Chinese Ambassador Wang Xiaoyao, one day after Costa Rican officials linked the January breach at ICE to the group UNC2814, which Google has described as a suspected People’s Republic of China nexus cyberespionage actor.
Wang said China wanted the evidence so the claims could be verified and, if warranted, prosecuted under the law. She also said Beijing has been trying since 2024 to engage Costa Rica on cybersecurity through technical consultations, professional exchanges, and other cooperation channels, but had received no reply from the Costa Rican side. The Chinese embassy also said it had proposed using mechanisms tied to the United Nations cybercrime framework and had sought to activate a bilateral joint commission that has still not taken place.
The dispute escalated after Costa Rican officials announced on March 12 that ICE had detected cyberespionage activity in administrative email systems. Authorities said the activity was first detected in late January and involved the extraction of about nine gigabytes of internal email data. ICE said the incident did not disrupt electricity or telecommunications services and did not compromise sensitive customer information.
Costa Rica’s government tied the operation to UNC2814 after receiving information from Mandiant, Google’s cybersecurity subsidiary, through the national incident response apparatus. Google said on February 25 that it had worked with partners to disrupt a global espionage campaign carried out by UNC2814, a group it has tracked since 2017. According to Google, the actor targeted telecommunications and government organizations across four continents and had confirmed intrusions in 42 countries at the time of the disruption.
That link is what turned a domestic cybersecurity incident into a diplomatic clash. China has not accepted the allegation and has instead framed the issue as one requiring technical proof, not political accusations. In its previous reaction in December 2024, after U.S. officials in Costa Rica pointed to cyber intrusions by groups located in China, the Chinese embassy rejected what it called U.S. defamation and interference in China–Costa Rica relations. It also said China opposes the politicization of cybersecurity disputes and supports handling cybercrime through dialogue and cooperation.
The latest exchange leaves Costa Rica facing pressure on two fronts. On one side, officials are publicly warning about foreign-linked cyberespionage affecting a major state institution. On the other, China is demanding proof and signaling that the fallout could spill into the broader bilateral relationship. For now, Costa Rican authorities have made the accusation public, but there is still no indication they have released detailed evidence to back it up.
