Ransomware attacks targeting Costa Rica increased by 39% over the past year, placing us among the world’s ten most affected nations, according to Microsoft’s 2026 Digital Defense Report. The seventh edition of the report ranked Costa Rica ninth globally for ransomware activity, behind Switzerland, which recorded a 103% increase, and ahead of Israel, where attacks rose by 21%.
According to Microsoft, ransomware activity targeting Costa Rica increased from 23 recorded instances to 32, based on data collected through the company’s global monitoring and threat intelligence systems. The findings highlight the growing cybersecurity challenges facing a country that has already experienced major cyberattacks against its public institutions.
In April 2022, the notorious Conti ransomware group targeted several Costa Rican government institutions, including the Ministry of Finance. The attack disrupted tax collection, customs operations, and other essential government services, prompting authorities to declare a national emergency.
Just weeks later, the Costa Rican Social Security Fund (CCSS) suffered another major cyberattack, attributed to the Hive ransomware group. The incident forced hospitals and healthcare facilities to shut down computer systems and temporarily rely on paper records, disrupting medical appointments and administrative operations.
These incidents exposed vulnerabilities in the digital infrastructure and demonstrated the potential consequences of cyberattacks on essential public services. Across the Americas, the United States, Canada, Brazil, Colombia, and Mexico were the countries where organizations were most frequently affected by cybercrime, according to Microsoft’s findings.
As part of its global efforts to disrupt criminal infrastructure, Microsoft’s Digital Crimes Unit (DCU) identified 1,459 victims in Costa Rica linked to various cybercriminal operations, including credential theft and malware campaigns. Globally, cybercriminals are also becoming faster at exploiting security vulnerabilities. Microsoft warned that the time between the discovery of a vulnerability and its exploitation can be less than 24 hours, significantly reducing the window available for organizations to identify and respond to threats.
To address these risks, Microsoft identified three priorities for organizations: protecting digital identities, accelerating threat detection and response, and strengthening cybersecurity resilience. Recommended measures include implementing stronger authentication mechanisms, reducing reliance on passwords, protecting high-value accounts, automating security responses whenever possible, and regularly testing incident response plans.
For Costa Rica, where previous ransomware attacks have already disrupted government operations and healthcare services, the latest findings underscore the importance of strengthening cybersecurity protections and safeguarding critical digital infrastructure.
