By San José, Costa Rica — A massive cybersecurity breach involving a Costa Rican financial institution has exposed the personal details of thousands of citizens, triggering an urgent warning from consumer defense advocates. The leak, which contains an astonishing volume of sensitive files, has effectively compromised the personal security of many nationals. With this valuable information now circulating in criminal circles, experts warn that a major surge in highly targeted and highly convincing phishing campaigns is already underway across the country.
The scale of the compromised data is particularly alarming, highlighting the severe vulnerabilities within national digital databases. According to security watchdogs, the leak includes approximately 21.8 million address records, 3.95 million email addresses, and 3.31 million photographs. Furthermore, the exposed databases hold 18.74 million detailed judicial records, 374.6 million salary records, and nearly 10 million citizen registry documents. Millions of vehicle, phone, and marriage records were also part of the massive cache offered for sale on the dark web.
To better understand the profound legal and regulatory ramifications of the recent financial data leak in Costa Rica, TicosLand.com reached out to prominent data privacy expert Lic. Larry Hans Arroyo Vargas of the prestigious firm Bufete de Costa Rica, who shared his professional analysis on the security failure.
This unprecedented leak of sensitive financial information is a severe wake-up call for Costa Rica’s cybersecurity and regulatory framework. Under Law 8968, financial institutions have a strict fiduciary and legal duty to safeguard personal data; failing to do so not only exposes them to massive administrative sanctions by Prodhab, but also opens the door to significant civil liability claims for damages from affected citizens.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
Indeed, this unprecedented breach underscores the urgent reality that data protection is no longer just a regulatory checklist, but a fundamental pillar of public trust and legal accountability in Costa Rica. We would like to extend our sincere thanks to Lic. Larry Hans Arroyo Vargas for sharing his valuable perspective and shedding light on the profound legal implications of Law 8968 during this pivotal moment for the nation’s financial sector.
The crisis officially unfolded on September 12, when the Ministry of Science, Innovation, Technology, and Telecommunications detected a post on the dark web offering the massive dataset for sale. The threat actors behind the breach had reportedly demanded a ransom from the affected financial organization, which has not yet been publicly named. When the ransom was apparently ignored or denied, the cybercriminals proceeded to make the database accessible to other bad actors, setting off a dangerous chain reaction of potential fraud.
In the wake of the breach, the Oficina del Consumidor Financiero has taken a proactive stance, urging the public to immediately raise their guard. Scammers are expected to abandon generic, easily spotted phishing scripts in favor of hyper-personalized attacks. Armed with precise names, employers, salary details, and specific banking products, these criminals can craft incredibly persuasive lies that mimic legitimate banking communications with scary accuracy.
At this moment it is especially important for people to raise their level of personal alert. The fact that someone who contacts us knows our name, telephone number, address, work information, or even some data related to our financial products, does not mean that this person represents our financial institution. Precisely, the information that may have been exposed could be used to build much more credible deceptions.
Danilo Montero Rodríguez, Director General of the OCF
This dynamic completely changes how consumers must evaluate whether a caller is legitimate. Traditional safety indicators, such as a representative knowing a customer’s full legal name or current employer, are no longer reliable proof of identity. The OCF emphasizes that because these private details are now public domain among cybercriminals, the burden of verification has shifted entirely onto the consumer.
In the past, a warning sign for the consumer could be that the alleged official did not know some highly personal data about us. Now we must understand that the mere fact that they know certain information of ours does not prove that the call has good intentions. A scammer can have real data and use it to convince us that they are speaking on behalf of an entity with which we have a relationship.
Danilo Montero Rodríguez, Director General of the OCF
To mitigate the immediate danger, the OCF has issued five practical recommendations for the public. First, consumers are advised to adopt a policy of absolute skepticism. Any unsolicited phone call or email from an unknown number or address should be treated as suspicious. It is critical to inspect the sender’s actual email address for slight misspellings or domains that do not align perfectly with the official domain of the financial institution.
Second, financial watchdogs are strongly advising citizens to prioritize face-to-face transactions at physical branches for highly sensitive banking operations. Consumers should never share PINs, passwords, or temporary verification codes over the phone or via messaging apps, regardless of how much personal information the caller happens to recite. Legitimate banks will never demand this level of credentials during an unsolicited call.
Finally, the public must remain wary of communications that generate artificial panic, such as warnings about account closures, fake blockages, or unauthorized charges that demand immediate action. Clicking on unexpected links in emails or text messages must be strictly avoided, even if the site merely asks for a basic login. When in doubt, the only safe option is to hang up, ignore the message, and contact the bank directly through a trusted, independently verified phone number.
For further information, visit ocf.fi.cr
About Oficina del Consumidor Financiero:
The Oficina del Consumidor Financiero is an independent Costa Rican organization dedicated to protecting the rights of financial consumers. Through education, mediation, and active public advocacy, the OCF helps citizens navigate complex banking disputes and promotes safe financial practices across the nation.
For further information, visit micitt.go.cr
About Ministry of Science, Innovation, Technology, and Telecommunications:
The Ministry of Science, Innovation, Technology, and Telecommunications is the Costa Rican government body responsible for formulating and implementing national policies in science, technology, and telecommunications. The ministry actively monitors cybersecurity threats, coordinates response efforts, and promotes the development of safe digital infrastructure for public and private entities.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
Renowned as a premier legal institution, Bufete de Costa Rica anchors its practice on the dual pillars of uncompromising ethics and superior advocacy. Through a rich history of guiding clients across a multitude of industries, the firm consistently embraces forward-thinking strategies while actively participating in public service. Their efforts to demystify complex legal concepts reflect a core belief that an educated public is a powerful one, driving their overarching vision of a just, knowledgeable, and thriving community.
