Costa Rica Investigates Massive Data Leak Affecting Millions, Including President

Ticotimes

Costa Rica Investigates Massive Data Leak Affecting Millions, Including President

First seen 16 Sep 2026, 13:53 UTC • •61.3

Article Content

1 / 3

Browse articles

ThreatCluster •September 16, 2026 at 15:33 UTC

•A dark web post claims to contain personal data of millions of Costa Ricans, including the president.
•Authorities confirmed that part of the leaked data is genuine, but the source remains unverified.
•The investigation involves multiple national agencies and potential links to a credit reporting agency.

Costa Rica's National Cybersecurity Directorate is investigating a dark web post claiming to hold tens of millions of personal records, including sensitive data of President Laura Fernández. The Ministry of Science, Innovation, Technology and Telecommunications (MICITT) confirmed that part of the published data is real but has not verified the source or extent of the breach. The data allegedly includes 400 million lines of information, covering salaries, addresses, phone numbers, and more. Investigators are exploring whether the data originated from a credit reporting agency or the Central Bank's registry. Authorities have not confirmed a recent breach or the authenticity of the data. Cybersecurity experts warn that the exposed information could facilitate fraud and identity theft. MICITT is collaborating with various national agencies and international partners to address the situation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-12

Dark web post discovered

MICITT detected a post claiming to have hacked a credit-reporting agency with extensive personal data.

2026-09-14

Investigation launched

Costa Rica's National Cybersecurity Directorate began investigating the authenticity and source of the data leak.

2026-09-15

Partial data verification

MICITT confirmed that part of a sample of 10,000 lines from the leak contains real information about individuals.

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
Phishing
T1566 - Phishing

Organization (1)

Finance Ministry

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Threat Actor (1)

Conti

Relationships

Conti uses Data Breach
Conti uses Phishing
Conti uses T1566 - Phishing
Conti targets Finance Ministry
Conti related to CWE-200 - Exposure of Sensitive Information

Following this threat?

Track Conti and Finance Ministry in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed…

Iranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding a spyware campaign attributed to Iranian state actors targeting dissidents, activists, and journalists. The malware, known as CHOSEN BRICK, is delivered through spear-phishing attacks on messaging platforms like WhatsApp and Telegram.…