Costa Rica investigates alleged massive data breach

Costa Rica’s Ministry of Science, Innovation, Technology and Telecommunications (MICITT) and the National Cybersecurity Directorate are investigating a potential massive data breach. The investigation follows a post on a dark web forum by a threat actor identified as ‘jarol1488’, who claims to have compromised a credit reporting agency and obtained tens of millions of records belonging to Costa Rican citizens and foreigners.

The alleged leak includes a vast array of sensitive information, such as identity card photographs, judicial records, salary histories, vehicle registrations, email addresses, and marriage records. While the threat actor claims to possess data affecting the entire population, authorities have not yet confirmed the authenticity of the files or the extent of the breach.

Cybersecurity expert Esteban Jiménez is currently analyzing JSON files to determine the database structure and origin. He is working alongside the Agency for the Protection of Inhabitants' Data (Prodhab) to identify the compromised systems. Officials noted that some reported figures, such as 374.6 million salary records, exceed the national population, suggesting the datasets may consist of database rows, duplicates, or historical entries rather than unique individuals.