The Government of Costa Rica announced today that the Costa Rican Electricity Institute (ICE) suffered a security attack linked to cyber espionage. Officials revealed the breach during an emergency press conference at Casa Presidencial. They said a threat actor with possible ties to China infiltrated ICE systems and extracted data.
The attack came to light after the Ministry of Science, Innovation, Technology and Telecommunications received an alert in February from Mandiant, a Google cybersecurity firm. The company flagged a breach in ICE infrastructure. Forensic analysis later confirmed the presence of the actor, who targets the telecom sector for espionage purposes.
Minister Paula Bogantes described the group as one that focuses on cyber espionage in telecommunications. She noted it has appeared in 42 countries and is already known internationally. ICE President Marco Acuña said the hackers pulled 9 gigabytes of internal emails from a server located in Costa Rica, not in the cloud. The utility holds far more data of that type, around 10,000 gigabytes in total, he added.
Acuña filed a criminal complaint with the Public Ministry and the Judicial Investigation Organization on Thursday. He called the act a crime under Costa Rican and international law. “We have profiled the threat and we are working on it,” he stated. “We are containing it.”
He stressed that basic telecom services continue to operate normally with no reported impact. Bogantes said the government treats the case as a national security matter. Costa Rican authorities reached out to the United States for technical support and coordination to handle the incident.
The government first spotted suspicious activity at ICE toward the end of January. Teams from the ministry and the utility then worked together on the review. Acuña confirmed the complaint includes a timeline of events. Authorities aim to identify those responsible and check for any local involvement.
This marks the latest cybersecurity challenge for Costa Rica’s critical infrastructure. Officials continue to monitor systems and strengthen defenses.
