Costa Rica: From cyber disaster to digital resilience

This case study documents the 2022 Costa Rica cyberattack and distils transferable lessons for other developing countries. In April 2022, Costa Rica became the first country in the world to declare a state of national emergency in response to a cyberattack.

A sustained ransomware campaign disrupted nearly 30 public institutions, generated aggregate losses of up to 2.4 percent of GDP, and tested every dimension of the country's institutional response. The report also sets out how cybersecurity risk is becoming a development risk, and how it is being integrated into the WBG's Crisis Preparedness and Response Toolkit — alongside natural disasters and pandemics.