More than 500,000 personal records managed by La Caja, the national public health and social security system of Costa Rica, were compromised by a network intrusion perpetrated by nefarious hackers. According to a news report filed by Lady Rojas for online news daily Costa Rica Hoy, officials from La Caja have identified the attackers, who are associates of a financial firm that performs contract work for the government.

The personal records compromised are part of La Caja’s Centralized Revenue System (Spanish acronym: SICERE). The Executive President of La Caja made an announcement on this matter yesterday, but the extent of the damage was not immediately explained. The economic loss and risk of identity theft is not known at this time; what is known, however, is that the two individuals believed to be responsible for this attack are being investigated and arrests may be forthcoming.

The Ministry of Public Security and the Data Protection Agency are currently working together to determine exactly what the hackers were trying to accomplish with this attack, which was allegedly carried out with the use of a botnet. A spokesperson from La Caja stated that this was a malicious act and not a test of the SICERE’s security, which has been augmented.

The SICERE platform runs on an Oracle Application Server. The system is used to manage collections of payments made to La Caja by employers and workers who contribute to the social security, public health and welfare of the people of Costa Rica. On any given payday, millions of dollars are collected by SICERE, and this is the same system that is currently being used to manage government pensions and disbursements of social security benefits.