Costa Rica Ransomware Attack 2022: Conti and the National Emergency
How Conti's April 2022 ransomware attack hit Costa Rica's customs and tax systems, why a national emergency followed, and what to check.
Breaches and penalties across Latin America and the Caribbean.
2 articles
Losses (bars) Complaints (line)
Ransomware and data-breach complaints from critical-infrastructure sectors, 2024 (number of complaints, not money)
Ransomware Data breach
Complaints to the FBI IC3 from organisations in 14 US critical-infrastructure sectors (2024 report, p.12). The 2025 report names the most-hit sectors but gives no counts. Source: FBI IC3 Internet Crime Report 2024.
Ransom received per group (USD millions)
Ransom payments received, as stated by officials. Figures cover different periods and aren't comparable totals.
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
What victims told the FBI they lost to cybercrime each year, from the annual reports of its Internet Crime Complaint Center (IC3). It counts every kind of cybercrime, not only data breaches: investment and romance fraud, business email compromise, ransomware and more. Most complaints come from the US. Read it as a floor: many victims never report, and no organisation publishes a worldwide total for breaches alone. 2012 and 2014 are missing because those reports give the total only inside a chart.
Sources
Average cost per data breach by industry (USD millions)
2026 2025
IBM/Ponemon, Cost of a Data Breach Report 2026, Figure 4. Earlier reports show industry costs only as chart images, so only 2026 and 2025 are listed. Source: IBM Cost of a Data Breach Report 2026.
Victims per group (number of organisations, not money)
Victims stated by officials (as-of dates differ)
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
The average cost of one breach across the organisations IBM/Ponemon studied that year. A single global average was first published with the 2014 study; earlier studies were country by country.
Sources
| Year | Latin America |
|---|---|
| 2026 | USD 3.03M ▼ below global average |
| 2025 | USD 2.52M ▼ below global average |
| 2024 | USD 2.76M ▼ below global average |
| 2023 | USD 2.46M ▼ below global average |
| 2022 | USD 2.09M ▼ below global average |
| 2021 | USD 1.82M ▼ below global average |
| 2020 | USD 1.40M ▼ below global average |
| 2019 | USD 1.35M ▼ below global average |
| 2018 | USD 1.24M ▼ below global average |
| 2017 | USD 1.52M ▼ below global average |
| 2015 | USD 1.77M ▼ below global average |
| 2014 | USD 1.61M ▼ below global average |
| 2013 | USD 1.32M |
Average total cost of a data breach as published in IBM/Ponemon "Cost of a Data Breach" reports, by report year, in US dollars. Early studies published only in local currency are left out, not converted. Each region is the average of the markets that year’s study reports for it (Latin America: Latin America, Brazil); hover a figure to see which. Years with no published figure are left out (the series starts in 2013); "Not in report" means that year’s study did not cover the region, not that it had no breaches. Averages are not added up across years: selecting several years on the map shows their average. Map colours run from yellow (lower cost) to dark red (higher cost), relative to the regions shown. ▲ / ▼: above or below that year’s global average cost per breach.
How Conti's April 2022 ransomware attack hit Costa Rica's customs and tax systems, why a national emergency followed, and what to check.
In 2022, valid credentials ran 90M+ queries on Brazil's INSS benefits system. What ANPD found, the sanction, and what to check in your own estate.