What happened

The ransomware group RansomHub compromised the IT systems of Refinadora Costarricense de Petróleo (RECOPE), Costa Rica's state oil refining and fuel-distribution company, gaining initial access via a phishing email and remaining undetected for several months before encrypting files and demanding a $5 million ransom on 27 November 2024, the day before the US Thanksgiving holiday. The attack disrupted RECOPE's operations for several days, causing fuel tanker trucks to back up at gas stations and forcing the company to process payments manually, prompting public concern reminiscent of the 2021 Colonial Pipeline ransomware incident in the United States. The US State Department's newly created Foreign Assistance Leveraged for Cybersecurity Operational Needs (FALCON) program deployed its first real-world rapid-response team in response, with a mixed team of government personnel and federal contractors arriving in San José within 36 hours. The team conducted forensic investigation, ransomware removal, data restoration from backups and system hardening, remaining on-site for approximately ten days with continued remote support through mid-December, at a total cost of roughly $500,000 drawn from a $10 million fund. US Ambassador Nate Fick said FALCON aimed to deliver swift, decisive support using 'best in breed' private-sector capabilities within 48 hours of a request. No physical damage to refining or pipeline infrastructure was reported.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.