Costa Rica Links ICE Email Breach to UNC2814 as China Demands Evidence
Summary
Costa Rica attributed a breach of ICE administrative email systems to UNC2814, reporting that about 9 GB of internal email data was extracted. ICE said services were unaffected and sensitive customer data was not compromised; China denied involvement and requested proof
Key points
- Costa Rican officials said ICE discovered cyberespionage activity affecting its administrative email systems, first detected in late January.
- Authorities reported that approximately 9 GB of internal email data was extracted.
- Costa Rica attributed the intrusion to UNC2814 based on intelligence from Mandiant shared through the national incident response system.
- ICE officials said electricity generation and telecommunications services were not disrupted and sensitive customer data was not compromised.
- China denied involvement and asked Costa Rica to provide technical evidence, proposing legal, UN-linked and bilateral mechanisms to examine the allegations.
- Google previously reported disrupting a UNC2814 campaign, with confirmed intrusions identified in 42 countries across four continents.
Article Details
- Victim Organization
- Costa Rican Electricity Institute (ICE)
- Incident Type
- Cyberespionage breach affecting administrative email systems
- Data Types Exposed
- Internal email data
- Affected Data Size
- Approximately nine gigabytes of internal email data
- Operational Impact
- ICE officials said electricity generation and telecommunications services were not disrupted and sensitive customer information was not compromised.
- Claim Status
- confirmed
People
Marco Acuña MoraICE executive president who said the incident did not disrupt critical infrastructure or compromise sensitive customer information.Paula Bogantes ZamoraCosta Rican minister who said the actor responsible for the ICE cyberattack specializes in targeting the telecommunications sector.Wang XiaoyaoChina's ambassador to Costa Rica publicly requested technical evidence supporting Costa Rica's cyberattack allegations and proposed legal channels for review.
Threat Actors
Vendors
Countries
ChinaTensions between China and Costa Rica have risen after Costa Rican authorities attributed a cyberespionage breach of the Costa Rican Electricity Institute’s administrative email systems to UNC2814, a group thatCosta RicaTensions between China and Costa Rica have risen after Costa Rican authorities attributed a cyberespionage breach of the Costa Rican Electricity Institute’s administrative email systems to UNC2814, a group that
Industries
ElectricityRica have risen after Costa Rican authorities attributed a cyberespionage breach of the Costa Rican Electricity Institute’s administrative email systems to UNC2814, a group that cybersecurity firms includingTelecommunicationsICE officials said electricity generation and telecommunications services were not disrupted and no sensitive customer data was compromised.