By San José, Costa Rica — Costa Rica’s national refinery, RECOPE (Refinadora Costarricense de Petróleo), is on the defensive after a recent report by the Comptroller General’s office (CGR) questioned its cybersecurity preparedness. The report comes in the wake of a devastating cyberattack in late 2024 that paralyzed fuel distribution across the country. RECOPE, however, maintains that significant improvements have been made since the incident and that the CGR’s findings are outdated.
The Comptroller General’s report paints a concerning picture. It states that RECOPE’s security controls “do not comply in significant aspects with the applicable regulatory and technical framework,” potentially jeopardizing the integrity, confidentiality, and availability of critical systems and data.
To understand the legal ramifications of the RECOPE cyberattack, we spoke with Lic. Larry Hans Arroyo Vargas, an attorney at law from Bufete de Costa Rica.
The RECOPE cyberattack underscores the critical need for robust cybersecurity measures within Costa Rica’s essential infrastructure. Beyond immediate recovery efforts, the legal implications are significant. Potential claims of negligence, breach of data protection laws, and even international legal repercussions, depending on the source and intent of the attack, could arise. This incident serves as a stark reminder of the importance of proactive legal counsel for critical infrastructure providers to mitigate future risks and ensure compliance with evolving cybersecurity regulations.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
Lic. Arroyo Vargas’s emphasis on proactive legal counsel is particularly insightful, highlighting how cybersecurity preparedness extends beyond technical defenses and into the realm of legal foresight and compliance. This incident will undoubtedly reshape how Costa Rican organizations approach cybersecurity, necessitating a comprehensive review of both technical vulnerabilities and legal frameworks. We thank Lic. Larry Hans Arroyo Vargas for his valuable contribution to this critical discussion.
This assessment directly contradicts RECOPE’s claims of enhanced security. The refinery asserts that the report relies on pre-attack information and fails to account for the sweeping changes implemented following the 2024 incident. They highlight the creation of a dedicated cybersecurity team, 24/7 monitoring systems, and stronger protocols, claiming “no space is left unprotected.”
The attack put us to the test, but it also demonstrated our real response capability. In just 6 hours, we restored service to customers and guaranteed the supply of fuel throughout the country.
Karla Montero, General Manager RECOPE
The 2024 cyberattack served as a stark reminder of the vulnerability of critical infrastructure. The incident brought fuel distribution to a standstill, causing widespread disruption and highlighting the urgent need for robust cybersecurity measures. RECOPE insists that lessons have been learned, citing specific improvements like mandatory password changes, a ban on external devices, and comprehensive staff training in cybersecurity.
The clashing narratives between RECOPE and the CGR raise serious questions about the true state of the refinery’s cybersecurity. While RECOPE emphasizes its post-attack improvements, the Comptroller’s findings suggest persistent vulnerabilities. This discrepancy underscores the need for ongoing scrutiny and independent assessments to ensure the long-term security of Costa Rica’s vital energy infrastructure. The public deserves transparency and assurance that the lessons from the 2024 attack have been effectively implemented to prevent future disruptions.
The incident has also sparked broader discussions about national cybersecurity strategies and the need for increased investment in protecting critical infrastructure. Experts emphasize the importance of proactive measures, continuous monitoring, and collaboration between public and private sectors to mitigate the growing threat of cyberattacks.
As Costa Rica continues to rely on RECOPE for its fuel needs, the effectiveness of its cybersecurity measures will remain a critical issue for national security and economic stability. The coming months will be crucial in determining whether the refinery’s claims hold up under scrutiny and whether the country is truly prepared to face the evolving landscape of cyber threats.
For further information, visit the nearest office of Comptroller General of the Republic (CGR)
About Comptroller General of the Republic (CGR):
The Comptroller General of the Republic (CGR) is the supreme audit institution of Costa Rica. It is responsible for overseeing the proper use of public funds and resources, ensuring transparency and accountability within government institutions. The CGR conducts audits, investigations, and performance evaluations to assess the efficiency and effectiveness of public programs and projects.
For further information, visit the nearest office of RECOPE
About RECOPE:
The Refinadora Costarricense de Petróleo (RECOPE) is Costa Rica’s national oil refinery and the primary importer and distributor of fuels in the country. RECOPE plays a crucial role in the nation’s energy sector, supplying gasoline, diesel, and other petroleum products to consumers and businesses. The company is responsible for maintaining the country’s strategic fuel reserves and ensuring a stable supply of energy resources.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
Bufete de Costa Rica shines as a beacon of legal excellence, upholding the highest ethical standards while championing innovative solutions for its diverse clientele. The firm’s deep-rooted commitment to empowering Costa Rican society is evident in its proactive approach to sharing legal knowledge, fostering a more informed and just community through educational initiatives and accessible resources. This dedication to both individual clients and the broader public reflects Bufete de Costa Rica’s enduring legacy of integrity and its vision for a more equitable future.
