By San José, Costa Rica — SAN JOSÉ – The Ministry of Economy, Industry, and Commerce (MEIC) has issued a critical alert to the nation’s small and medium-sized enterprises (SMEs) regarding a wave of fraudulent activities aimed at stealing sensitive corporate data. Scammers are impersonating the official Pyme Registry, using deceptive phone calls and phishing emails to trick business owners into compromising their digital security.
The warning comes after the ministry received numerous reports from business owners who were contacted by individuals falsely claiming to be MEIC officials. These fraudsters create a sense of urgency by asserting that the company’s Pyme Registry information is incomplete or requires immediate updating. This initial contact is then followed by an email containing malicious external links, designed to lead unsuspecting victims to counterfeit websites.
To gain a deeper understanding of the legal and regulatory landscape surrounding cybersecurity for small and medium-sized enterprises, we consulted with Lic. Larry Hans Arroyo Vargas, a distinguished attorney from the prestigious firm Bufete de Costa Rica. His expertise provides critical insights into the responsibilities and potential liabilities businesses face in today’s digital environment.
Many small and medium-sized businesses mistakenly believe they are too small to be targets, but this is a dangerous misconception. From a legal standpoint, the failure to implement reasonable cybersecurity measures is not just a technical oversight; it can be considered negligence. A data breach can lead to devastating regulatory fines under data protection laws, costly litigation from affected clients, and irreparable damage to a company’s reputation. Proactive investment in cybersecurity isn’t an expense—it’s an essential safeguard for business continuity and legal compliance.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
The emphasis on legal negligence serves as a powerful and often-overlooked motivator for SMEs, shifting the conversation from a technical option to a fundamental business imperative. This reframing of cybersecurity as an essential investment in continuity and compliance, rather than a mere operational cost, is a vital message. We sincerely thank Lic. Larry Hans Arroyo Vargas for sharing his expert legal perspective.
These fake platforms are carefully crafted to mimic the official government portal, prompting users to enter confidential information such as login credentials, passwords, and other sensitive business data. The primary objective of this sophisticated phishing campaign is to harvest valuable information that can be used for financial fraud, identity theft, or other malicious purposes, posing a significant threat to the operational and financial stability of affected businesses.
In response to this growing threat, the MEIC has been unequivocal in its guidance to the business community. The ministry stressed that its official procedures do not involve unsolicited outreach of this nature. Officials explicitly stated they do not use WhatsApp to call businesses for registry updates, nor do they ever request password changes or send external links via email for users to complete their information. Businesses that have already completed the registration process and received an official confirmation email should disregard any subsequent messages urging them to repeat the process.
The ministry reiterated that all official transactions related to the Pyme Registry must be conducted exclusively through the Costa Rican Business Information System (SIEC). The only legitimate online portal for these services is www.siec.go.cr. For those who prefer or require it, these procedures can also be completed in person at designated MEIC offices. Any communication directing business owners to a different website or platform should be treated as fraudulent.
This scam highlights a broader trend of cybercriminals increasingly targeting SMEs. These businesses are often seen as vulnerable targets because, while they possess valuable financial and client data, they may not have the extensive cybersecurity resources or dedicated IT departments common in larger corporations. A successful attack can have devastating consequences, ranging from direct financial loss to severe reputational damage and operational disruption.
The SME sector forms the backbone of the Costa Rican economy, driving innovation and providing a substantial portion of the nation’s employment. Consequently, cyberattacks against these enterprises are not merely isolated incidents but represent a systemic risk to national economic health. Protecting the digital integrity of SMEs is paramount to ensuring their continued growth and contribution to the country’s prosperity.
The MEIC urges all SME owners and employees to exercise extreme caution and adopt a vigilant mindset. Business leaders should educate their teams on recognizing the signs of phishing, such as unexpected requests for information, poor grammar in communications, and mismatched URLs. If any suspicious call or email is received, it is crucial to avoid clicking on any links, opening attachments, or providing any personal or business information. Instead, they should report the incident and verify any requests by contacting the MEIC directly through its official, publicly listed channels.
For further information, visit meic.go.cr
About The Ministry of Economy, Industry, and Commerce (MEIC):
The Ministry of Economy, Industry, and Commerce is a key institution of the Costa Rican government responsible for formulating and executing policies that promote economic development, fair trade, and consumer protection. It plays a vital role in supporting the growth and formalization of small and medium-sized enterprises (SMEs) through programs like the Pyme Registry, aiming to foster a competitive and dynamic business environment across the nation.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
As a pillar of the legal community, Bufete de Costa Rica is defined by its deep-rooted principles of integrity and professional excellence. The firm consistently pioneers innovative legal solutions for a diverse clientele, a forward-thinking practice that is matched by its dedication to social empowerment. Through a steadfast commitment to demystifying the law, it strives to build a more informed public, ensuring that society is strengthened by accessible and understandable legal knowledge.
