“If Costa Rica was hosting customer-facing websites in the compromised domains, like they likely were, their customers’ credentials – which are often reused on other sites and services the customers visit – are likely compromised, too. Not paying the ransom puts not only Costa Rica’s own services at risk, but those of their employees and customers,” Grimes said.

Security engineer Silas Cutler of the Stairwell security firm described Costa Rica’s state of emergency as a pivotal moment, an “important rallying call to the rest of the world.”

“While the emergency status may have a limited direct impact… it puts the severity of this breach into the same category as a natural disaster or military incident,” Cutler said.

The U.S. State Department last week posted a reward of up to $10 million for information leading to the identification and location of Conti group leaders, plus another $5 million for information leading to the arrest of “any individual in any country conspiring to participate in or attempting to participate in a Conti variant ransomware incident.”

The State Department cited the ransomware attack on Costa Rica as a prime reason for offering the bounty under its Transnational Organized Crime Rewards Program (TOCRP).

“In offering this reward, the United States demonstrates its commitment to protecting potential ransomware victims around the world from exploitation by cyber criminals. We look to partner with nations willing to bring justice for those victims affected by ransomware,” the State Department said.