Cyber Incident Victim: Costa Rican Ministry of Foreign Affairs and Worship
Date:
Jan 2016
Location:
Costa Rica
Summary
A hacktivist associated with the LulzSec movement compromised the Costa Rican Ministry of Foreign Affairs and Worship's systems, leaking personal data including names, email addresses, national identification numbers, phone numbers, and hashed passwords belonging to approximately 530 users. The attacker, operating under the alias Hanom1960, claimed the breach was part of the #OpPuraVida campaign targeting opposition to the Central America Free Trade Agreement (CAFTA), citing concerns over its alleged negative effects on labor and human rights. The intrusion was publicly framed as exposing vulnerabilities within government infrastructure to pressure policy changes.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In January 2016, a hacker operating under the alias Hanom1960 and identifying as affiliated with the LulzSec movement breached the Costa Rican Ministry of Foreign Affairs and Worship's official website (rree.go.cr). The attacker publicly claimed responsibility through the Twitter account @hanomlulzsec and released a data dump containing sensitive information from the ministry's systems. This breach occurred as part of a broader hacktivist campaign labeled #OpPuraVida, which explicitly targeted opposition to the Central America Free Trade Agreement (CAFTA). The compromised data included names, email addresses, national identification card numbers, phone numbers, and hashed passwords belonging to approximately 530 users associated with the ministry. The hacker stated the intrusion was intended to demonstrate vulnerabilities within Costa Rican government infrastructure while advancing political objectives related to trade policy criticism.
The #OpPuraVida campaign specifically criticized CAFTA's perceived negative impacts on labor conditions and human rights protections in Costa Rica. Hanom1960 framed the breach as a means to pressure the Costa Rican government into rejecting the trade agreement by exposing systemic security weaknesses. No specific technical details about the attack methodology or initial access vectors were disclosed in available reports. Similarly, there is no documented information regarding how or when the ministry detected the breach, nor any confirmed containment or remediation measures taken by the government. The primary confirmed consequence was the unauthorized disclosure of personally identifiable information and credential data, which created potential risks for affected individuals. The hacker's public statements emphasized ideological motivations tied to trade policy opposition rather than financial gain or widespread disruption of government operations.