Puerto Rico Government Agency Exposed 1 Million Social Security Numbers

Puerto Rico's property tax agency, CRIM, inadvertently exposed approximately 1 million Social Security numbers through its Catastro Digital map, allowing anyone with technical knowledge to download unprotected data without authentication. Despite notification by Centro de Periodismo Investigativo and ProPublica in mid-June 2026, Executive Director Javier García Cintrón denied any breach occurred, even after security holes were patched. The incident is part of a pattern: over 2 million cyberattacks targeted Puerto Rico government systems in 2026, with 60% of agencies failing required vulnerability assessments under Act 40.

CRIM data exposure incident

• ▪The Centro de Recaudación de Ingresos Municipales (CRIM) in Puerto Rico inadvertently exposed the Social Security numbers of approximately 1 million people through its Catastro Digital interactive property map.
• ▪Anyone who understood how websites request data could download unprotected personal information, including Social Security numbers, from the Catastro Digital without a username or password.
• ▪The Catastro Digital online tool provides information such as size, boundaries, tax assessment, sale price, and owner's name for every registered property in Puerto Rico.
• ▪Centro de Periodismo Investigativo and ProPublica notified CRIM of the vulnerability in mid-June 2026 with a detailed description including the specific server and folders containing compromised data.

Government denial of breach

• ▪A few days after Centro de Periodismo Investigativo and ProPublica contacted CRIM, the security holes in the Catastro Digital had been patched.
• ▪CRIM did not notify users that their Social Security numbers were potentially exposed, with García stating no protected information was at risk.
• ▪CRIM Executive Director Javier García Cintrón denied there was any vulnerability of confidential personal taxpayer information, stating the Catastro Digital does not contain or display such information.
• ▪CRIM did not notify the Puerto Rico Innovation & Technology Service (PRITS) about the security incident, despite government cybersecurity protocol requiring such notification.
• ▪Javier García Cintrón denied that CRIM corrected any security problems, stating there was no need to fix any alleged problem.

Puerto Rico cyberattack pattern

• ▪In 2023, Puerto Rico water utility clients and employees saw their personal information published on the dark web after a ransomware attack on the Autoridad de Acueductos y Alcantarillados.
• ▪In March 2026, Puerto Rico citizens saw driver's license and registration appointments postponed after an attempted cyberattack on Transportation Department systems.
• ▪Half of the attempted cyberattacks on Puerto Rico government systems in 2026 were deemed critical incidents involving severe impact on critical operations or compromise of sensitive data.
• ▪Puerto Rico lawmakers approved Act 40 in 2024, a comprehensive cybersecurity law mandating all government agencies implement minimum cybersecurity standards and conduct risk assessments at least once annually.
• ▪In 2025, Puerto Rico residents could not verify their criminal record status for almost a week due to unauthorized access to the Justice Department's criminal records database.

Cybersecurity law implementation gaps

• ▪A Puerto Rico Inspector General Office report released in late 2025 found deficiencies across 90 local government agencies, with 60% failing to conduct vulnerability assessments of their IT systems.
• ▪Three cybersecurity experts said Puerto Rico government agencies have failed to fully implement the security standards set out under Act 40, even as attacks become more frequent and sophisticated.
• ▪Carlos Pérez, director of security intelligence at TrustedSec, said the Puerto Rico government would be in much better shape if it focused on employee training and implemented multifactor authentication.
• ▪The ability to access Social Security numbers through CRIM's property map raises concerns given the proliferation of private companies that sell Puerto Rico real estate information obtained from public databases such as Catastro Digital.

Real estate data company concerns

• ▪At least three property listings companies contacted by Centro de Periodismo Investigativo and ProPublica said they were not aware of any vulnerability and did not access the sensitive data.

2 sources