A Puerto Rico Government Agency Exposed 1 Million Social Security Numbers

The recent revelation that the Municipal Revenue Collection Center in Puerto Rico inadvertently exposed the Social Security numbers of approximately 1 million people is just the latest example of a larger, systemic problem plaguing the island’s government. For years, Puerto Rico has been beset by a rash of cybersecurity breaches, each one more egregious than the last.

The incident at hand involves an interactive property map called Catastro Digital, which contains sensitive information about every registered property on the island. Initially, this tool seemed innocuous enough, but it had vulnerabilities that could be exploited by anyone with even a basic understanding of website functionality to access personal data, including Social Security numbers. News organizations that uncovered the issue were able to verify the security hole and provide the agency with detailed instructions on how to patch it.

Despite being notified about the vulnerability in mid-June, the agency repeatedly denied that any problems existed, even after the issue had been patched a few days later. This lack of transparency is particularly concerning given Puerto Rico’s history of cybersecurity mishaps and the fact that the law requires prompt notification to users when their personal information has been compromised.

The consequences of such an event would be catastrophic, leaving countless individuals vulnerable to identity theft and financial ruin. With private companies already profiteering from public databases like Catastro Digital, it’s not a stretch to imagine that sensitive data could have ended up on the dark web.

The problem here is not just with CRIM or even the Puerto Rico government as a whole, but with the patchwork approach to cybersecurity that pervades the island’s institutions. For years, lawmakers have been aware of the need for comprehensive cybersecurity standards, yet despite passing Act 40 in 2024, agencies seem to be more focused on firefighting than prevention.

Cybersecurity experts point out that the law falls short by not requiring unified standards across government agencies, allowing each institution to decide how to protect personal data on its own. This lack of cohesion is a recipe for disaster, as demonstrated by CRIM’s failure to notify PRITS, the agency responsible for overseeing all government IT systems.

The Inspector General Office report released last year found that 90 local government agencies had deficiencies in their cybersecurity practices, with 60% failing to conduct regular vulnerability assessments. Implementing tools like multifactor authentication and providing employee training would be a far more effective approach than simply reacting to each new breach as it occurs.

As one expert noted, “We are addressing the symptom but not the disease.” In an era where cyber threats are becoming increasingly sophisticated and frequent, Puerto Rico’s haphazard approach to cybersecurity is a ticking time bomb waiting to go off. It’s time for the government to take a hard look at its patchwork policies and implement unified standards that prioritize prevention over patching up holes after they’ve been exploited.

As of writing, it remains unclear whether CRIM or any other agency has taken concrete steps to address these vulnerabilities or improve their cybersecurity posture. One thing is certain: Puerto Rico’s citizens deserve better than a government that consistently prioritizes convenience and expediency over their safety and security.