Hive ransomware followed stolen credentials into Costa Rica's CCSS

Hive ransomware struck Costa Rica's Caja Costarricense de Seguro Social (CCSS) in late May 2022, weeks after Conti had already forced the government to declare a national emergency. Attackers gained initial access with stolen credentials and then moved directly to ransomware deployment. No second authentication step stood between the foothold and the encryption of healthcare systems.

Costa Rica's social security agency (CCSS) had already endured weeks of disruption from the Conti ransomware group when Hive operators appeared on the same networks. Attackers used credentials that granted immediate entry to internal systems, then moved laterally and deployed encryption without any additional login step.

According to Verizon's 2023 DBIR, stolen credentials were the top action variety in 44.7 percent of the 4,354 incidents analyzed that year. The CCSS case matched the pattern: the password alone opened the door.

How the attackers reached CCSS networks

Public reports showed no zero-day exploit or supply-chain compromise. The operators simply presented credentials that had either persisted from the earlier Conti incident or been obtained through phishing and password reuse. Once accepted, those credentials produced live sessions the attackers could use across multiple systems.

CCSS systems contain patient records and benefits data. With valid sessions already established, the operators enumerated servers, located backups, and started encryption without triggering any second authentication check at any boundary.

Why the password alone was sufficient

No second factor stood between the stolen credentials and the first internal session. The attackers never needed an OTP code, a push approval, or a hardware signature because none was required. The same credential weakness had already let Conti spread; Hive simply reused the open path.

According to IBM's 2025 Cost of a Data Breach Report, incidents that begin with stolen credentials carry elevated costs precisely because the initial access requires no further attacker effort once the first login succeeds.

The same credential path had already succeeded once. Nothing in the second incident indicated that the underlying authentication controls had changed.

FAQ

How did the attackers get into CCSS?

The attackers got into CCSS by presenting stolen employee credentials that required no second factor. Those credentials produced live sessions that let the operators reach internal systems and deploy Hive ransomware without any further authentication.

Would an OTP or push notification have stopped Hive at CCSS?

An OTP or push notification would have blocked the initial login because the attackers only possessed the password. A valid second factor would have been required before any session token was issued.

Why did the same vector work twice in Costa Rica?

The same vector worked twice because the first compromise left reusable credentials that Hive simply reused. No hardware-bound check existed on either intrusion, so the password alone remained sufficient.

What changed for later Costa Rican government systems?

Later systems began requiring hardware-backed signatures on every request instead of trusting a single session token created from a password. That change removed the reusable credential path both Conti and Hive had exploited.