CCSS Hive ransomware attack

On 31 May 2022, the Caja Costarricense de Seguro Social (CCSS) — the institution that runs Costa Rica's entire public health system and social-security collection — was struck by the Hive ransomware group. Coming just weeks after the Conti attacks that had already pushed the country into a national state of emergency, the CCSS intrusion turned a financial and administrative crisis into a public-health emergency.

What happened

In the early hours of 31 May, CCSS technicians detected "anomalous information flows" on the network. As a precaution they shut down critical infrastructure, but it was already too late: networked printers across hospitals began spitting out Hive ransom notes and pages of garbled characters, the classic signature of an active encryption event.

Initial reports suggested around 30 servers were hit. Within a day, officials revised that dramatically upward — more than 800 servers and roughly 9,000 end-user computers had been compromised, making the institution's planned one-week recovery impossible.

Impact

The CCSS deliberately took its flagship systems offline to contain the spread, including the Expediente Digital Único en Salud (EDUS) — the unified national electronic health record — and its EDAC backup. With EDUS unavailable, clinicians across the country could not pull up patient histories, prescriptions, or lab results.

• Hospitals and clinics reverted to pen-and-paper workflows, with the vast majority of facilities running contingency plans.
• The first day alone saw roughly 4,871 missed appointments across some 80 health establishments; thousands more were cancelled over the following days.
• Pharmacy dispensing, lab processing, and the SICERE social-security collection system were all disrupted.

On 2 June, Hive demanded approximately $5 million in bitcoin. Consistent with the government's stance during the Conti episode, the CCSS refused to pay and rebuilt from backups.

Attribution

Hive was a prolific ransomware-as-a-service operation with a documented preference for healthcare targets. The group leased its malware to affiliates who carried out intrusions and split the proceeds. Hive's infrastructure was later seized in a coordinated FBI-led international takedown in January 2023, after the Bureau had quietly infiltrated the gang and distributed decryption keys to victims.

Why it matters

The CCSS attack is a textbook example of how ransomware against a single national institution can endanger lives at scale. Unlike the Conti attack, which mainly paralysed tax and customs systems, Hive struck the backbone of a country's healthcare delivery. It hardened Costa Rica's resolve to never pay, accelerated investment in national cyber-defence, and became a reference case for the systemic risk that under-protected public-health IT poses across Latin America.