Correos de Costa Rica faces critical cybersecurity vulnerabilities

The Comptroller General of the Republic (CGR) has identified 18 high-impact and critically severe vulnerabilities within the digital service infrastructure of Correos de Costa Rica. An audit covering the period from January 2024 to August 2026 concluded that the institution maintains a “reactive and disjointed” approach to cybersecurity.

The report highlights a widespread failure to comply with technical and regulatory information security frameworks. Out of 70 vulnerabilities identified through penetration testing, 34 remain unaddressed. The CGR warned that operating with end-of-life infrastructure and unresolved critical risks increases the institution's exposure to cyberattacks that could compromise the availability, integrity, and confidentiality of information.