Costa Ricans scrambled to pay taxes by hand after cyberattack took down country’s collection system

Costa Ricans struggled to pay taxes by hand Monday after a ransomware cyberattack took down the country’s online tax collection system.

Several Costa Rican government agencies, including its Ministry of Finance, are severely hampered after an international cybercriminal gang called Conti locked them in April and demanded a ransom payment to make them operable again. The country’s new leader, President Rodrigo Chaves, declared a state of emergency after the attack last week soon after being sworn in.

Ransomware attacks have become commonplace in recent years, with cybercriminals often strategically attacking businesses and smaller government organizations at times when a shutdown would come at a high cost in order to incentivize victims to pay.

Cybersecurity firm Emsisoft has estimated that ransomware attacks cost victims more than $600 million in the U.S. last year. But the attack on Costa Rica’s government is the largest known single criminal ransomware attack to date against one country’s government.

Costa Ricans normally pay taxes through an online system, which is still inoperable with Ministry of Finance networks down. The country has delayed some tax deadlines until at least August because of the attack. But it’s still collecting a monthly value-added tax on sales and imports. 

With no option to pay the VAT online, the Ministry of Finance has instructed citizens to download a program called EDDI7, which only works on Windows operating systems, then fill in their tax information, print out a form and physically take that to a government-approved bank to pay their taxes.

That system has led to a host of problems, like customers waiting at banks for hours to pay on Monday, reported El Financiero, a Costa Rican financial newspaper.

Alex Vargas, a photographer who lives in a coastal area far from the capital of San José, said since he only uses Mac computers at his office, he had to take his business filings home to use the program on his home computer, then spend the day traveling to and from an approved bank because his local one wasn’t authorized to collect the VAT.

“The whole country is trying to pay taxes at the same time,” Vargas told NBC News in a Twitter direct message. “Going to a bank is not the problem. The problem is wasting 2 hours there or more.”

And the EDDI7 app is counterintuitive, Vargas said. 

“The app looks like a program from more than 20 years ago,” he said.

Conti, one of the most notorious active cybercriminal gangs, had previously locked up computer networks for Ireland’s national health care system, with estimated costs associated with the attack rising as high as 100 million euros ($105 million).

After the cyberattack on Costa Rica, the U.S. State Department offered a reward of $10 million for information leading to Conti leaders.

In remarks Monday, Chaves said Conti had collaborators working within his country’s government, according to an account of a news conference translated and reported by Costa Rican news outlet The Tico Times.

“We are at war and that is not an exaggeration,” Chaves said. “People inside the country are collaborating with Conti.”