The Puerto Rico government agency responsible for collecting property taxes inadvertently exposed the Social Security numbers of approximately 1 million people, according to an investigation by Centro de Periodismo Investigativo (CPI) and ProPublica.

The vulnerability was linked to the Municipal Revenue Collection Center’s (CRIM) interactive property map, known as the Catastro Digital. This online tool provides details such as size, boundaries, tax assessment, sale price, and owner names for every registered property on the island. While a basic search of the map does not reveal sensitive data, individuals with technical knowledge could exploit how the website requests data to download unprotected personal information, including Social Security numbers, without needing a username or password.

CRIM Executive Director Javier García Cintrón stated, “Following a review of the Catastro Digital platform, it was determined that there was NO breach of confidential personal taxpayer information, as the Catastro Digital does NOT contain or display the type of information alluded to.”

A spokesperson for the Puerto Rico Information Technology Services (PRITS) declined to answer questions, noting that inquiries must be submitted under Puerto Rico’s public information law, which is designed to provide citizens access to government records rather than to respond to press questions.

This incident adds to a series of cybersecurity issues faced by the Puerto Rico government in recent years. In 2023, personal information of water utility clients and employees was published on the dark web following a ransomware attack. Additionally, last year, residents were unable to verify their criminal record status for nearly a week due to unauthorized access to the Justice Department’s criminal records database.

Cybersecurity expert Carlos Pérez, director of security intelligence at TrustedSec, emphasized that the government would be in “much better shape” if it prioritized employee training and implemented tools like multifactor authentication.

Sources