Costa Rica’s National Cybersecurity Directorate is investigating a dark web posting in which an unidentified threat actor claims to hold tens of millions of personal records belonging to people in this country, including identity card photographs, court files, vehicle registrations, salary histories and marriage records.
The Ministry of Science, Innovation, Technology and Telecommunications (MICITT) confirmed that the directorate detected the publication and opened a technical analysis to determine whether the material is authentic, where it came from, how large it is, and how many people it affects. The ministry said it is also working to establish whether the systems or information of any national institution have been compromised.
MICITT was emphatic on one point. It cannot currently confirm that a recent breach occurred, nor that the published data is genuine. The ministry said it will release verified details only when doing so does not compromise the investigation or the response measures underway.
Cybersecurity specialist Esteban Jiménez raised the alarm on the posting, which he said advertises personal, financial, legal, employment, property and vehicle information along with photographs of Costa Rican citizens. According to the listing attributed to the threat actor, the datasets would include 21.8 million address records, 3.95 million email addresses, 3.31 million photographs, 18.74 million detailed judicial or legal records and a further 8.1 million judicial records.
The same listing claims 374.6 million salary records, 9.95 million citizen records, 3.52 million vehicle records, 3.39 million beneficial ownership records, 13.45 million telephone records and 2 million marriage records. None of those counts has been independently verified. Several of them exceed the national population of roughly five million, which indicates that the figures describe database rows rather than individual people, and would include historical entries, duplicates and multiple records attached to the same person.
The threat actor appears to have used information relating to President Laura Fernández as a sample of what it claims to possess. Jiménez said the published material includes personal data on the president, among it references to where she lives and to properties she is reported to hold, and that the decision to foreground the head of state was itself striking given the volume of other material on offer.
Investigators are working with two hypotheses about the origin. Jiménez said one possibility is a database belonging to a credit reporting agency, a type of firm that aggregates identity, employment and debt information on borrowers. The second, he said, is that part of the material corresponds to the data structure of the Central Bank’s Transparency and Beneficial Ownership Registry, and that what was posted resembles the beneficial ownership structures used by central banks.
That registry, known by its Spanish initials RTBF, requires every corporation and private trust registered in Costa Rica to declare the real individuals who own or control it. Filings run annually through the Central Bank’s Central Directo platform and require a digital signature card. The registry exists to support enforcement against tax fraud, money laundering and terrorist financing, which means it concentrates ownership information on property-holding companies in a single national database.
Jiménez said analysts were downloading part of the published sample in order to share it with colleagues and compare it against known database structures. He added that photographs of identity cards also appeared in the sample, which raises the severity of what may be circulating. He stressed that the work remains at an investigative stage and that a clearer picture depends on further material being released.
Neither the Central Bank nor the Agency for the Protection of Inhabitants’ Data, known as PRODHAB, had issued a public statement on the posting by Monday morning. The source of the data and the true scale of the alleged leak remain unconfirmed.
Costa Rica has been here before. The Conti ransomware attack of April 2022 crippled Finance Ministry systems, disrupted customs and tax collection for weeks, and prompted the first national emergency declaration issued anywhere in the world over a cyberattack. That episode reshaped how the country treats digital infrastructure, and it is the reference point against which the current investigation will be judged.
Until the origin is established, the practical response does not change, and it is the same whether the dump is genuine, recycled from older breaches, or partly fabricated. Treat unsolicited contact as suspect, particularly if the caller already knows details about you. Banks, government agencies and SINPE Móvil never ask for a full card number, a one-time code or a PIN by phone, WhatsApp or text. A caller who opens with your correct cédula number and address is demonstrating that they bought a file, not that they work at your bank.
Do not click links in messages claiming your data has been leaked, and do not pay anyone who offers to remove your record from a database. Both are standard follow-on scams that arrive in the days after a leak becomes public, and they succeed precisely because the underlying fear is reasonable.
Turn on two-factor authentication for email and banking, and change any password reused across more than one account. Ask your bank to alert you before any new product is opened in your name, and request your file from the credit reporting agencies so you can see what is on it.
Property owners should periodically check their entries at the Registro Nacional for unexpected annotations, liens or powers of attorney. Fraudulent transfers executed through forged or misused powers of attorney are a recurring problem in Costa Rica, and ownership records combined with identity documents are exactly the raw material such schemes require.
Anyone who files corporate declarations should guard their digital signature card and PIN as carefully as a bank card, and store the two separately. Suspected misuse of personal data can be reported to the Judicial Investigation Agency, and complaints about the handling of personal data fall to PRODHAB.
