RansomHub ransomware group lists recope.go.cr on its leak site

• Ransomware group: RansomHub
• Country: Costa Rica
• Sector: Energy & Utilities
• Announcement date: December 12, 2024

RansomHub claims responsibility for RECOPE data leak

The Costa Rican state-owned energy entity, RECOPE, has been listed on the leak site of the RansomHub ransomware group. According to the announcement made on December 12, 2024, the group claims to have obtained sensitive information belonging to the organization following a cyberattack that reportedly occurred on December 9, 2024. This incident follows a common pattern in modern cybercrime known as double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data to use as leverage during ransom negotiations.

Ransomware leak sites serve as a public platform for these criminal groups to pressure victims. By publishing samples of stolen information, attackers aim to damage the reputation of the target and increase the pressure to pay. While the specific details regarding the volume of data stolen or the specific ransom demand have not been disclosed by the group, the publication of document samples confirms the group's claim of a successful breach.

Details of the alleged data exfiltration

The RansomHub group has published various samples of documents that they claim are related to the operational and administrative processes of RECOPE. Based on the screenshots provided by the attackers, the leaked information includes a variety of sensitive materials that could impact both the organization and its personnel. The data reportedly includes:

• Employee identification data
• Corporate correspondence
• Commercial proposals
• Technical drawings

The presence of such diverse data types suggests that the attackers may have gained access to multiple internal systems, ranging from administrative communication channels to technical project repositories. The inclusion of images of employee identification cards is particularly concerning for individual privacy.

About RECOPE

RECOPE (Refinadora Costarricense de Petróleo) is the state-owned oil refinery and fuel distribution company of Costa Rica. As a critical component of the nation's infrastructure, the organization is responsible for the country's energy infrastructure and the management of the fuel supply chain. Given its role in managing essential resources, any disruption or data compromise involving such an entity carries significant implications for national energy security and operational continuity.

Impact assessment and organizational risks

The exposure of this data presents several significant risks. At an individual level, the leak of employee identification documents increases the risk of identity theft for the affected staff members. At a corporate level, the publication of technical drawings, maps, and commercial proposals could potentially harm the organization's competitive advantage and weaken its overall operational security. Furthermore, the organization may face legal consequences under Costa Rican data protection regulations due to the exposure of sensitive information.

Given the history of the RansomHub group—which emerged in early 2024 and reportedly ceased operations in early 2025, and has been associated with ALPHV affiliates—there is a possibility that the leaked data could be utilized for secondary attacks or targeted phishing campaigns. In such scenarios, attackers use stolen corporate details to craft highly convincing fraudulent communications to deceive employees or business partners.

For organizations operating in the energy and utilities sector, maintaining robust defensive postures is essential. This typically involves implementing strict access controls, continuous monitoring of network traffic, and ensuring that sensitive technical documentation is stored in isolated, highly secure environments. Regular audits of data protection compliance and employee training regarding phishing awareness are also standard defensive measures to mitigate the impact of such breaches.