Puerto Rico Tax Agency Leaks 1 Million Social Security Numbers

Puerto Rico's Municipal Revenue Collection Center (CRIM) has inadvertently exposed the Social Security numbers of approximately one million individuals through a vulnerability in its online property tax database. The breach was discovered by investigative journalists from Centro de Periodismo Investigativo and ProPublica, who notified CRIM about the security flaw in mid-June. The Catastro Digital platform, which provides detailed information on properties across Puerto Rico, allowed anyone with basic web knowledge to download sensitive personal data without needing a username or password.

This incident is part of a larger pattern of cybersecurity failures within Puerto Rican government agencies over recent years. In 2023, for instance, a ransomware attack led to the publication of private information on the dark web. More recently, in March, citizens faced delays in obtaining driver’s license and vehicle registration appointments due to cyberattacks on transportation systems. Despite these recurring issues, CRIM has denied any breach occurred, stating that no protected information was at risk.

The Puerto Rico Innovation & Technology Service (PRITS), which oversees government IT systems, was not informed of the vulnerability until after it had been fixed. This contravenes PRITS's cybersecurity protocol requiring notification for suspected security incidents. Furthermore, CRIM failed to notify affected individuals as required by law when personal data is compromised.

Experts warn that Puerto Rico’s cybersecurity challenges stem from inadequate implementation of protective measures and a lack of unified standards across government agencies. The passage of Act 40 in 2024 aimed to address these issues but has not yet led to significant improvements, with many agencies still failing to conduct regular vulnerability assessments.