Puerto Rico’s Property Tax Agency Exposed 1 Million Social Security Numbers, Highlighting Systemic Cybersecurity Failures

A significant cybersecurity lapse within the Municipal Revenue Collection Center (CRIM) in Puerto Rico inadvertently exposed the Social Security numbers (SSNs) of approximately 1 million individuals, a joint investigation by Centro de Periodismo Investigativo (CPI) and ProPublica revealed. This incident marks the latest in a troubling series of technological breaches that have plagued the Puerto Rico government over the past three years, leading to disruptions in essential services, website outages, and the compromise of citizens’ sensitive personal information, some of which has surfaced on the dark web. The vulnerability, identified within CRIM’s interactive property map known as the Catastro Digital, allowed sophisticated users to access confidential data without requiring any authentication credentials, raising severe concerns about data privacy and the government’s commitment to cybersecurity.

Discovery and the Agency’s Contradictory Response

The vulnerability came to light in mid-June when CPI and ProPublica researchers uncovered the flaw in the Catastro Digital system. This online tool, designed to provide public information such as property size, boundaries, tax assessments, sale prices, and owner names for every registered property across the island, inadvertently housed a critical security flaw. While a standard search on the public-facing map would not reveal sensitive data, individuals with an understanding of how websites request and retrieve backend data could easily download unprotected personal information, including Social Security numbers, without needing a username or password.

Upon verifying the security hole, the news organizations promptly notified CRIM, providing the agency with a detailed description of the issue, including the specific server and folders that contained the compromised data. Despite this clear and actionable notification, CRIM’s Executive Director, Javier García Cintrón, repeatedly denied the existence of any problems with its system. In a public statement, García Cintrón asserted, “Following a review of the Catastro Digital platform, it was determined that there was NO breach of confidential personal taxpayer information, as the Catastro Digital does NOT contain or display the type of information alluded to.”

However, within days of the news organizations contacting CRIM, evidence suggested that the security holes had been quietly patched. García Cintrón, however, continued to deny that any fixes were necessary or implemented, maintaining that no problem existed. This stance is particularly concerning given Puerto Rico law, which mandates that any entity, including government agencies, must promptly notify users if their personal information has been breached. García Cintrón explicitly stated that CRIM would not reach out to affected users, reiterating his claim that “no protected information was at risk.”

Adding to the agency’s lack of transparency, CRIM also failed to notify the Puerto Rico Innovation & Technology Service (PRITS), the entity responsible for overseeing all government information technology systems. Government cybersecurity protocols explicitly require informing PRITS of "any suspected security incident." When questioned, a PRITS spokesperson declined to answer, stating that inquiries had to be submitted under Puerto Rico’s public information law, a process designed for citizens to obtain government records, not for press inquiries, thereby sidestepping immediate accountability.

The Anatomy of the Vulnerability and its Potential Reach

The Catastro Digital, while a valuable resource for public property information, demonstrated a critical backend flaw. The vulnerability was not in the data displayed on the public interface, but in the underlying architecture that allowed for direct access to the database itself. This meant that while an average user searching for a property would only see publicly available details, an attacker or a technically proficient individual could bypass the public interface and directly query the servers holding the detailed records. This method of data extraction, known as an insecure direct object reference (IDOR) or a similar API vulnerability, is a common weakness when web applications do not properly validate user permissions or requests for data at the backend level.

The sheer volume of exposed data—approximately 1 million Social Security numbers—represents a significant portion of Puerto Rico’s population, which stands at around 3.2 million. The exposure of SSNs, a cornerstone of personal identity in the United States and its territories, places individuals at severe risk of identity theft, financial fraud, and other malicious activities. Such data can be used to open fraudulent bank accounts, obtain credit cards, file false tax returns, or even access government benefits, leading to profound and long-lasting financial and personal distress for the victims.

Further compounding the risk is the proliferation of private companies that aggregate and sell Puerto Rico real estate information, often sourcing data from public databases like Catastro Digital. While at least three property listing companies contacted by CPI and ProPublica denied awareness of the vulnerability and claimed not to have accessed sensitive data, the possibility remains that these companies, or other less scrupulous entities, could have inadvertently or deliberately accessed and stored this highly sensitive personal information. The unregulated nature of data aggregation markets adds another layer of concern, as once data is collected by third parties, its subsequent use and security become even more difficult to monitor and control.

A Pattern of Systemic Cybersecurity Failures

The CRIM incident is not an isolated event but rather a stark illustration of a pervasive and systemic cybersecurity problem within the Puerto Rico government. Over the past three years, the island has witnessed a series of high-profile cyberattacks and data breaches that have severely impacted government operations and citizens’ trust.

• 2024 Transportation Department Attack: In March of this year, an attempted cyberattack on the Transportation Department’s systems forced the postponement of driver’s license and vehicle registration appointments, disrupting essential services for thousands of residents.
• 2023 Justice Department Breach: Last year, Puerto Rico residents were unable to verify their criminal record status for nearly a week due to “unauthorized access” to the local Justice Department’s criminal records database. The inability to obtain these records, often a prerequisite for employment, caused significant economic hardship and delays.
• 2023 Water Utility Ransomware: In 2023, clients and employees of Puerto Rico’s water utility experienced the exposure of their personal information on the dark web following a ransomware attack. This incident highlighted the devastating impact of such attacks, which not only lock down systems but also exfiltrate and publish sensitive data.

PRITS data underscores the scale of the threat, reporting over 2 million attempted cyberattacks against the Puerto Rico government so far this year. Alarmingly, half of these were classified as "critical incidents," defined as events with "severe impact on critical operations, the compromise of sensitive data, or an imminent threat to agency security or government data." This relentless barrage of attacks, coupled with the recurring successful breaches, paints a grim picture of the government’s defensive posture.

Legislative Responses and Implementation Shortcomings

In response to the escalating cyber threats, Puerto Rico lawmakers approved a comprehensive cybersecurity law, Act 40, in 2024. This legislation was intended to be a turning point, mandating that all government agencies implement minimum cybersecurity standards and principles, conduct annual risk assessments, and established penalties for noncompliance. The goal was to foster a proactive and unified approach to cybersecurity across the government.

However, despite the legislative framework, cybersecurity experts express significant skepticism regarding its effective implementation. Three independent cybersecurity experts consulted on the matter unanimously stated that agencies have largely failed to fully implement the security standards outlined in Act 40. They argue that government entities remain largely reactive, addressing vulnerabilities only after an attack or discovery, rather than proactively assessing and tackling potential weaknesses that could prevent future incidents.

This reactive approach was corroborated by a Puerto Rico Inspector General Office report released late last year. The report found widespread deficiencies across 90 local government agencies, with a staggering 60% of them failing to conduct vulnerability assessments of their IT systems. This critical oversight leaves agencies blind to their own weaknesses, making them easy targets for increasingly sophisticated cybercriminals.

Carlos Pérez, a cybersecurity expert in Puerto Rico and director of security intelligence at TrustedSec, a firm that advises both governments and private companies, emphasized the need for fundamental changes. He argued that the government would be in "much better shape" if it prioritized employee training and implemented basic but effective tools like multifactor authentication (MFA) on the front end of its systems. "We are addressing the symptom but not the disease," Pérez stated, highlighting a fundamental flaw in the current strategy.

Another former government IT employee, who requested anonymity due to fears of professional repercussions, pointed out a significant loophole in Act 40. He explained that the law often falls short of requiring truly unified standards across all government agencies. This lack of a single, overarching set of mandates allows individual agencies too much discretion in deciding how they will protect personal data, leading to inconsistent security postures and potential weak links in the overall government IT infrastructure.

Broader Implications and the Erosion of Public Trust

The exposure of 1 million Social Security numbers carries profound implications for the citizens of Puerto Rico. Beyond the immediate threat of identity theft, it erodes public trust in government institutions responsible for safeguarding their most sensitive data. In an era where digital interactions are increasingly integral to daily life, citizens expect their government to be a reliable custodian of personal information. Repeated breaches and denials of responsibility undermine this foundational trust, potentially leading to reluctance in using online government services, which in turn can hinder efficiency and accessibility.

The economic impact of such breaches can also be substantial. Victims of identity theft often incur significant financial losses, spend countless hours rectifying fraudulent accounts, and face long-term damage to their credit scores. For a territory that has faced numerous economic challenges, the added burden of widespread identity theft could have ripple effects on individual financial stability and the broader economy.

CRIM’s continued denial of a breach, despite evidence of a quiet patch and the explicit findings of the news organizations, further compounds the issue. Executive Director García Cintrón maintains that CRIM utilizes security measures such as passwords, usernames, and text messages for identity validation, asserting that direct access to the Catastro Digital database without a password is not possible, except for individual public searches. This assertion directly contradicts the method by which CPI and ProPublica accessed the compromised data, highlighting a potential disconnect between the agency’s understanding of its system’s security and the reality of its vulnerabilities.

The PRITS spokesperson’s refusal to answer direct questions, instead demanding formal public information requests, also signals a broader lack of transparency and accountability within the government’s cybersecurity response framework. This bureaucratic hurdle makes it difficult for the public and the press to obtain timely and critical information about incidents that directly affect citizens’ privacy and security.

In conclusion, the CRIM data exposure incident serves as a critical wake-up call for the Puerto Rico government. It underscores not only the urgent need for robust technical cybersecurity measures but also for a fundamental shift in institutional culture towards proactive vulnerability management, transparent communication, and consistent enforcement of cybersecurity standards across all agencies. Without a comprehensive and unified strategy, backed by unwavering commitment from leadership, the citizens of Puerto Rico will remain vulnerable to an ever-evolving landscape of cyber threats, with their personal data continually at risk.