Costa Rica

Situation Summary

Costa Rica faces a convergence of elevated cyber risk, persistent violent crime, and political tension in the week ending 21 September 2026. A claimed mass data breach affecting 400 million records, combined with active ransomware threats against critical water infrastructure, has exposed millions of residents to identity and financial theft. Simultaneously, gang violence in Limón and San José, alongside large-scale security operations targeting transnational criminal networks, underscores ongoing cartel infiltration and localized homicide risk.

Key Developments

• San José, 14 September: Exiled Nicaraguan opposition figure Reinaldo Picado Miranda ("Commander Omar") was shot three times by unidentified assailants while renovating a property; he was hospitalized and placed under OIJ protection, raising questions about political violence and regional refugee security.

• Nationwide (dark web), 12–19 September: A dark-web actor claimed exfiltration of over 400 million lines of personal and financial data from a Costa Rican credit reporting agency, including addresses, salaries, court records, phone numbers, and photos. Costa Rica's data-protection authority (Prodhab) opened an administrative investigation on 18–19 September, with parallel criminal and cybersecurity-directorate inquiries underway.

• Sarapiquí water sector, 15 September: Ransomware group ArcusMedia publicly claimed a cyberattack against Asada Sarapiquí water utility, threatening data disclosure and setting a 22 September deadline; the incident exposes operational and customer data in the Sarapiquí service area.

• Cariari de Pococí, Limón province, 16 September: A shooting at a roast meat sale left two men dead and one seriously wounded, continuing a pattern of violent crime in the Caribbean region.

• Multi-provincial operation, 17 September: Security forces deployed over 1,200 officers across Limón, Alajuela, San José, and Puntarenas, conducting 67 searches and arresting 29 of 57 suspects in a large anti-gang operation targeting structures used by transnational criminal organizations.

• Cartago and San José, 14–17 September: During Independence Eve ceremonies (14 September), police implemented intensive security measures in Cartago's Plaza Mayor, including metal perimeters, checkpoints, and bag searches; at least one non-lethal weapon was seized. Teachers' unions barred from the event have appealed to the Constitutional Chamber, citing repressive policing.

• San José, 15 September: Thousands of demonstrators rallied against President Laura Fernández's proposed judicial reforms, with police deploying barriers and checkpoints around Plaza Mayor and restricting opposition participation; police managed minor confrontations, though opposition groups alleged "represión."

• San José (foreign policy), 19–20 September: Foreign Minister Manuel Tovar publicly condemned Cuba as a "vile tyranny" and reaffirmed the break in diplomatic relations announced in March, signaling hard-line foreign policy with potential regional implications.

Highest-Risk Areas

Sub-national risk ranking is unavailable; however, Limón province and San José emerge as highest-risk areas within the data. Limón is marked by concentrated gang activity, violent-crime shootings, and transnational cartel infiltration, while San José remains the nexus of national cyber infrastructure, mass-protest activity, and political instability. Both regions warrant heightened operational vigilance for corporate personnel and asset protection.

How GeoBit Would Assist

Corporate security teams would deploy AOI Monitoring & Early Warning on San José, Cartago, and Limón to track protest activity, gang operations, and police responses in real time. Intel Sweep and OSINT fusion capabilities would corroborate dark-web breach claims and track ransomware-group communications, enabling early notification of water and financial-sector threats. Network & Actor Analysis would map transnational gang structures and cartel outsourcing patterns feeding into Costa Rican enforcement operations.

7-Day Outlook

The 22 September ransomware deadline on Asada Sarapiquí presents an immediate critical-infrastructure risk; parallel data-breach investigation outcomes are expected to emerge mid-week. Gang enforcement momentum will likely continue, with spillover violent-crime risk elevated in Limón and peripheral San José neighborhoods through month-end. Political protest activity around judicial reform may resume if constitutional court decisions shift, sustaining police-presence and civil-liberties tension in urban centers.

Previous Weekly Briefs

A new Costa Rica brief is written every Monday, covering the week — each with its own risk map and downloadable CSV. Use the calendar to go further back.

• September 14, 2026⬇ CSV · $5
• September 7, 2026⬇ CSV · $5
• September 1, 2026⬇ CSV · $5
• August 30, 2026⬇ CSV · $5
• August 27, 2026⬇ CSV · $5
• August 25, 2026⬇ CSV · $5
• August 23, 2026⬇ CSV · $5