Cyber Incident Victim: Banco BCR
Date:
Aug 2019
Location:
Costa Rica
Summary
Hackers linked to the Maze Ransomware group breached the state-owned Banco BCR, stealing approximately 11 million credit card credentials—including 4 million unique entries and 140,000 tied to U.S. individuals—along with several years of other data. The attackers claimed to have accessed the network twice, abstaining from encryption due to concerns over excessive damage and global circumstances, but exfiltrated sensitive information and posted partial card details as proof. They attempted to negotiate a ransom with the bank, threatening to sell the stolen data on the dark web if demands were unmet.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In August 2019, operators of the Maze Ransomware allegedly infiltrated the network of Banco BCR, Costa Rica's state-owned bank, but chose not to deploy encryption due to concerns over the potential scale of damage. The attackers claimed the bank failed to remediate security vulnerabilities, enabling them to regain network access in February 2020. During this second intrusion, Maze exfiltrated multiple years of data, including 11 million credit card credentials. The stolen dataset purportedly contained 4 million unique credit cards, with approximately 140,000 belonging to U.S. citizens. Attackers publicly disclosed partial card details—including redacted numbers, expiration dates, and CVC codes—for 240 accounts as evidence of compromise. Maze representatives stated they refrained from encrypting systems during the 2020 breach due to ethical considerations amid the global pandemic.
The ransomware group attempted to contact Banco BCR multiple times with unspecified ransom demands, threatening to sell the data on dark web markets if negotiations failed. Maze framed their actions as a service exposing security deficiencies, asserting their intrusion demonstrated how "half a bank could be pulled out" through systemic vulnerabilities. Banco BCR did not publicly acknowledge the incident or respond to media inquiries from BleepingComputer regarding the alleged breach. Financial impact estimates and details about affected internal systems remained undisclosed by both the attackers and the bank. Customers were advised by third parties to monitor accounts for fraudulent activity, though no official bank communications were referenced in available reports. The incident highlighted Maze's pattern of targeting high-profile organizations, following previous attacks against Cognizant, Chubb, and Hammersmith Medicines Research LTD.