{"id":117,"date":"2026-07-11T06:49:15","date_gmt":"2026-07-11T06:49:15","guid":{"rendered":"https:\/\/maxinefilmes.com\/odelator\/puerto-rico-crim-data-breach\/"},"modified":"2026-07-11T09:35:21","modified_gmt":"2026-07-11T09:35:21","slug":"puerto-rico-crim-data-breach","status":"publish","type":"post","link":"https:\/\/maxinefilmes.com\/odelator\/puerto-rico-crim-data-breach\/","title":{"rendered":"A Puerto Rico Government Agency Exposed 1 Million Social Security Numbers"},"content":{"rendered":" <article class=\"wp-block-group p-grid-text-container is-layout-flow wp-block-group-is-layout-flow\"> <header class=\"wp-block-group entry-header is-layout-flow wp-container-core-group-is-layout-3ce78d47 wp-block-group-is-layout-flow\"><div class=\"wp-block-propublica-opener\">  <div class=\"wp-block-group p-opener p-opener--medium p-opener--left p-opener--order-hed-art-dek is-layout-flow wp-container-core-group-is-layout-a77db08e wp-block-group-is-layout-flow\">  <div class=\"wp-block-group p-opener__art-wrapper is-layout-flow wp-container-core-group-is-layout-a77db08e wp-block-group-is-layout-flow\">  <figure> <img decoding=\"async\" class=\"p-opener__art\" alt=\"Hand-shaped cursors surround a Social Security card.\" width=\"1149\" height=\"766\" src=\"https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?w=1149\" srcset=\"https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg 3000w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=300,200 300w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=768,512 768w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=1024,683 1024w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=1536,1024 1536w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=2048,1365 2048w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=863,575 863w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=422,281 422w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=552,368 552w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=558,372 558w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=527,351 527w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=752,501 752w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=1149,766 1149w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=459,306 459w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=2000,1333 2000w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=400,267 400w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=800,533 800w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=1200,800 1200w, https:\/\/www.propublica.org\/wp-content\/uploads\/2026\/06\/20260626-Gordon-PR-SSN-breach-3x2_maxHeight_3000_maxWidth_3000.jpg?resize=1600,1067 1600w\" sizes=\"(max-width: 800px) 100vw, 800px\" style=\"object-position: 50% 50%;\" fetchpriority=\"high\">  <figcaption class=\"p-attribution\">  <span class=\"p-attribution__credit\"> Illustration by Shoshana Gordon\/ProPublica <\/span> <\/figcaption> <\/figure>  <\/div>    <div class=\"wp-block-group p-opener__topic-title-dek-wrapper is-layout-flow wp-block-group-is-layout-flow\">   <h1 class=\"p-opener__hed  wp-block-post-title\">A Puerto Rico Government Agency Exposed 1 Million Social Security Numbers<\/h1>   <h2 class=\"p-opener__dek wp-block-propublica-dek\"> A cybersecurity loophole in an official government mapping service left private data easily accessible, Centro de Periodismo Investigativo and ProPublica learned.<\/h2>  <\/div>  <\/div>   <div class=\"wp-block-group p-article-meta-1 p-article-meta-1--left is-layout-flow wp-block-group-is-layout-flow\"> <div class=\"p-article-meta-1__byline wp-block-propublica-byline\"> <div class=\"wp-block-propublica-byline__right\"> <div class=\"wp-block-propublica-byline__content\"> <span class=\"wp-block-propublica-byline-text\">by <\/span><span class=\"wp-block-propublica-byline-profile\"><a href=\"#\" data-broken-external-link=\"true\">Luis Valent\u00edn<\/a><\/span><span class=\"wp-block-propublica-byline-text\">, <\/span><span class=\"wp-block-propublica-byline-organization\"><a href=\"#\" data-broken-external-link=\"true\">Centro de Periodismo Investigativo<\/a><\/span><span class=\"wp-block-propublica-byline-text\">, and <\/span><span class=\"wp-block-propublica-byline-profile\"><a href=\"https:\/\/maxinefilmes.com\/odelator\/\">Nick McMillan<\/a><\/span><span class=\"wp-block-propublica-byline-text\">, <\/span><span class=\"wp-block-propublica-byline-organization\"><a href=\"https:\/\/maxinefilmes.com\/odelator\/\">ProPublica<\/a><\/span>\t\t<\/div> <p class=\"wp-block-propublica-byline__partners\"> Co-published with <a href=\"#\" data-broken-external-link=\"true\">Centro de Periodismo Investigativo<\/a>\t\t\t<\/p> <\/div> <\/div>   <div class=\"p-article-meta-1__pubdate wp-block-post-date\"><time datetime=\"2026-07-09T05:00:00-04:00\">July 9, 2026, 5:00 am<\/time><\/div>   <div class=\"wp-block-group p-article-meta-1__section-actions p-article-meta-1__section-actions--left is-layout-flow wp-block-group-is-layout-flow\">  <div class=\"wp-block-group p-article-meta-1__section-actions-container is-nowrap is-layout-flex wp-container-core-group-is-layout-6c531013 wp-block-group-is-layout-flex\"> <div class=\"wp-block-propublica-news-over-audio-listen-button\">  <div class=\"wp-block-buttons is-layout-flex wp-container-core-buttons-is-layout-b7003702 wp-block-buttons-is-layout-flex\">  <div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button ready\" href=\"#news-over-audio-player\"> <svg aria-hidden=\"true\" focusable=\"false\" width=\"20\" height=\"20\" class=\"icon\"><use href=\"#am-symbol-play\"><\/use><\/svg> <span class=\"wp-block-propublica-news-over-audio-listen-button__label\">Listen<\/span> <span class=\"wp-block-propublica-news-over-audio-listen-button__timestamp\">06:34<\/span> <\/a><\/div>  <\/div> <div class=\"news-over-audio-player__super-wrapper\"> <div class=\"news-over-audio-player__wrapper\"> <div class=\"news-over-audio-player__loading-animation\"> <svg aria-hidden=\"true\" focusable=\"false\" width=\"24\" height=\"24\" class=\"icon\"><use href=\"#am-symbol-loader\"><\/use><\/svg>\t\t\t<\/div> <iframe loading=\"lazy\" src=\"about:blank\" id=\"news-over-audio-player\" width=\"292\" height=\"204\" scrolling=\"no\" frameborder=\"0\" class=\"news-over-audio-player\" referrerpolicy=\"strict-origin-when-cross-origin\" data-play-url=\"https:\/\/embed-player.newsoveraudio.com\/v6?key=U5u4k53XOI9fy337Nd4R3ueC6n5dz038&amp;id=https%3A%2F%2Fwww.propublica.org%2Farticle%2Fpuerto-rico-crim-data-breach\"><\/iframe> <\/div> <div class=\"news-over-audio-player__close-button\" aria-label=\"Close\"> <svg aria-hidden=\"true\" focusable=\"false\" width=\"24\" height=\"24\"><use href=\"#am-symbol-close\"><\/use><\/svg>\t\t<\/div> <\/div> <\/div>     <div class=\"wp-block-propublica-translation-links\"> <div class=\"wp-block-buttons is-layout-flex wp-container-core-buttons-is-layout-3c3b2af7 wp-block-buttons-is-layout-flex\"> <div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/maxinefilmes.com\/odelator\/\"> <svg aria-hidden=\"true\" focusable=\"false\" width=\"24\" height=\"24\" class=\"icon\"><use href=\"#am-symbol-globe\"><\/use><\/svg>\t\tLeer en espa\u00f1ol <\/a><\/div>  <\/div><\/div>     <div style=\"display: contents\"> <!--[--><div class=\"share-tools\" data-pp-click=\"\" data-pp-location=\"share tools\"><!--[--><!--[--><!--$s1--><!--[0--><div class=\"svelte-1ear6bd button--circle\" style=\"display: contents; --button-bg-color: var(--p-dyn-color-white); --button-text-color: var(--p-dyn-color-gray-05); --button-border: 1px solid var(--p-dyn-color-gray-01); --button-font-size: var(--p-scale-4);\"><!--[--><!----><button data-button-root=\"true\" type=\"button\" tabindex=\"0\" id=\"bits-s1\" aria-haspopup=\"dialog\" aria-expanded=\"false\" data-state=\"closed\" data-popover-trigger=\"\" aria-label=\"Share\"><span aria-hidden=\"true\" style=\"display: contents\"><svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><g clip-path=\"url(#clip0_149_321)\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M4 11C4.55228 11 5 11.4477 5 12V20C5 20.2652 5.10536 20.5196 5.29289 20.7071C5.48043 20.8946 5.73478 21 6 21H18C18.2652 21 18.5196 20.8946 18.7071 20.7071C18.8946 20.5196 19 20.2652 19 20V12C19 11.4477 19.4477 11 20 11C20.5523 11 21 11.4477 21 12V20C21 20.7957 20.6839 21.5587 20.1213 22.1213C19.5587 22.6839 18.7957 23 18 23H6C5.20435 23 4.44129 22.6839 3.87868 22.1213C3.31607 21.5587 3 20.7956 3 20V12C3 11.4477 3.44772 11 4 11Z\" fill=\"currentColor\"><\/path><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M11.2929 1.29289C11.6834 0.902369 12.3166 0.902369 12.7071 1.29289L16.7071 5.29289C17.0976 5.68342 17.0976 6.31658 16.7071 6.70711C16.3166 7.09763 15.6834 7.09763 15.2929 6.70711L12 3.41421L8.70711 6.70711C8.31658 7.09763 7.68342 7.09763 7.29289 6.70711C6.90237 6.31658 6.90237 5.68342 7.29289 5.29289L11.2929 1.29289Z\" fill=\"currentColor\"><\/path><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M12 1C12.5523 1 13 1.44772 13 2V15C13 15.5523 12.5523 16 12 16C11.4477 16 11 15.5523 11 15V2C11 1.44772 11.4477 1 12 1Z\" fill=\"currentColor\"><\/path><\/g><defs><clipPath id=\"clip0_149_321\"><rect width=\"24\" height=\"24\" fill=\"white\"><\/rect><\/clipPath><\/defs><\/svg><!----><\/span><!----><!----><\/button><!----><!--]--><\/div><!----><!--]--><!----><!--]--> <!--[--><!--[-1--><!--]--><!--]--><!----><!----><!--]--><\/div><!--]--> <\/div>     <div style=\"display: contents\"> <!--[--><div class=\"dark-mode-toggle svelte-1l6vey\"><div class=\"svelte-1ear6bd button--circle\" style=\"display: contents; --button-bg-color: var(--p-color-page-bg); --button-text-color: var(--p-dyn-color-gray-05); --button-border: 1px solid var(--p-dyn-color-gray-01); --button-font-size: var(--p-scale-4);\"><!--[--><!----><button data-button-root=\"true\" tabindex=\"-1\" aria-hidden=\"true\"><span aria-hidden=\"true\"><!--[-1--><svg role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><title>Contrast<\/title><circle cx=\"12\" cy=\"12\" r=\"10\"><\/circle><path fill=\"currentColor\" d=\"M12 18a6 6 0 000-12v12z\"><\/path><\/svg><!--]--><\/span><!----><!----><\/button><!----><!--]--><\/div><!----> <label class=\"p-a11y\" for=\"dark-mode-toggle__select\">Change Appearance<\/label> <select class=\"dark-mode-toggle__select svelte-1l6vey\" id=\"dark-mode-toggle__select\" data-pp-change=\"true\" data-pp-category=\"change-mode\"><!--[--><option value=\"auto\" selected=\"\">Auto<\/option><option value=\"light\">Light<\/option><option value=\"dark\">Dark<\/option><!--]--><\/select><\/div><!--]--> <\/div>  <\/div>  <\/div>  <\/div>  <\/div> <\/header>    <div class=\"wp-block-group article-body is-layout-flow wp-block-group-is-layout-flow\">  <aside class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\"><div class=\"wp-block-propublica-notes--top wp-block-propublica-notes\"> <div class=\"wp-block-propublica-note--co-publish wp-block-propublica-note\">   <p><em>This article was produced for ProPublica\u2019s Local Reporting Network in partnership with <\/em><a href=\"#\" data-broken-external-link=\"true\"><em>Centro de Periodismo Investigativo<\/em><\/a><em>. <\/em><a href=\"https:\/\/maxinefilmes.com\/odelator\/\" data-gtm-vis-recent-on-screen102051180_42=\"247\" data-gtm-vis-first-on-screen102051180_42=\"247\" data-gtm-vis-total-visible-time102051180_42=\"100\" data-gtm-vis-has-fired102051180_42=\"1\"><em>Sign up for Dispatches<\/em><\/a><em> to get our stories in your inbox every week.<\/em><\/p>  <\/div> <\/div> <\/aside>   <div class=\"entry-content wp-block-post-content is-layout-flow wp-block-post-content-is-layout-flow\"> <p>The government agency that collects property taxes in Puerto Rico inadvertently exposed the Social Security numbers of approximately 1 million people, Centro de Periodismo Investigativo and ProPublica learned.<\/p>    <p>It was the latest cybersecurity lapse for the Puerto Rico government, which in the past three years has seen technology breaches interrupt government services, take websites offline and lead to citizens\u2019 personal information being published on the dark web.<\/p>    <p>CPI and ProPublica became aware of the vulnerability related to the Municipal Revenue Collection Center\u2019s interactive property map, known as the Catastro Digital, and notified the agency in mid-June.<\/p>    <p>The online tool provides information, such as size, boundaries, tax assessment, sale price and owner\u2019s name, for every registered property on the island.<\/p>    <p>While a simple search of the map wouldn\u2019t reveal sensitive information, anyone who understands how websites request data could download unprotected personal information such as Social Security numbers without a username or password.<\/p>    <p>The news organizations were able to verify the security hole and provided the agency, known by its Spanish initials, CRIM, with a detailed description of the issue that included the specific server and folders that contained the compromised data.<\/p> <div class=\"p-hide-print p-bb--size-full wp-block-propublica-ad-slot\"> <div id=\"bsa-zone_1760102005055-6_123456\" data-google-query-id=\"CMiyjYuEypUDFasGHgAdyN8neA\" data-hidden-by=\"google\" style=\"display: none;\"><div id=\"google_ads_iframe_\/22960212090,2219821\/Propublica_S2S_InlineBanner1_ROS_0__container__\" style=\"border: 0pt; margin: auto; text-align: center; width: 728px; height: 0px;\"><\/div><\/div> <\/div>    <p>Despite the notification, CRIM has repeatedly denied there were any problems with its system.<\/p>    <p>\u201cFollowing a review of the Catastro Digital platform, it was determined that there was NO breach of confidential personal taxpayer information, as the Catastro Digital does NOT contain or display the type of information alluded to,\u201d CRIM Executive Director Javier Garc\u00eda Cintr\u00f3n said.<\/p>    <p>But a few days after CPI and ProPublica contacted CRIM, the news organizations were able to see that the security holes had been patched.<\/p>    <p>Garc\u00eda denied that, saying there was no need to fix any problem. A Puerto Rico law requires any entity, including government agencies, to promptly notify users if their personal information has been breached. But Garc\u00eda said the agency would not reach out to users to tell them that their Social Security numbers were potentially exposed, as \u201cno protected information was at risk.\u201d<\/p>    <p>CRIM also did not notify the Puerto Rico Innovation &amp; Technology Service, known as PRITS, which oversees all government information technology systems. The government\u2019s cybersecurity protocol requires informing PRITS of \u201cany suspected security incident.\u201d<\/p>    <p>A PRITS spokesperson declined to answer questions and said they had to be submitted under Puerto Rico\u2019s public information law, which is meant to allow citizens to get government records and not to answer press questions.<\/p>    <p>So far this year, more than 2 million attempted cyberattacks have been recorded within the Puerto Rico government, PRITS data shows. Half of these were deemed critical incidents, which involve \u201csevere impact on critical operations, the compromise of sensitive data, or an imminent threat to agency security or government data,\u201d according to the agency.<\/p>    <p>In March, citizens saw their driver\u2019s license and registration appointments postponed after an attempted cyberattack on Transportation Department systems. Last year, Puerto Rico residents could not verify their criminal record status, which they need for employment, for almost a week because of an \u201cunauthorized access\u201d to the local Justice Department\u2019s criminal records database. In 2023, Puerto Rico water utility clients and employees saw their personal information published on the dark web after a ransomware attack.<\/p>    <p>An increase in attacks prompted Puerto Rico lawmakers in 2024 to approve a comprehensive cybersecurity law, Act 40, which mandated all government agencies implement minimum cybersecurity standards and principles. It also established penalties for noncompliance and required all government agencies to conduct a risk assessment at least once annually.<\/p>    <p>But three cybersecurity experts said agencies have failed to fully implement the security standards set out under the law, even as attacks become more frequent and sophisticated. Instead of periodically assessing and tackling vulnerabilities that prevent these attacks, agencies are reactive, they said.<\/p>    <p>A Puerto Rico Inspector General Office report released late last year found deficiencies across 90 local government agencies, with 60% of them failing to conduct vulnerability assessments of their IT systems.<\/p>    <p>The government would be in \u201cmuch better shape\u201d if it focused on employee training and implemented tools like multifactor authentication on the front end, said Carlos P\u00e9rez, a cybersecurity expert in Puerto Rico who is director of security intelligence at TrustedSec, a company that consults with governments and private companies.<\/p> <div class=\"p-hide-print p-bb--size-full wp-block-propublica-ad-slot\"> <div id=\"bsa-zone_1760102469343-3_123456\" data-google-query-id=\"CMmyjYuEypUDFasGHgAdyN8neA\" style=\"display: none;\" data-hidden-by=\"google\"><div id=\"google_ads_iframe_\/22960212090,2219821\/Propublica_S2S_InlineBanner2_ROS_0__container__\" style=\"border: 0pt; margin: auto; text-align: center; width: 728px; height: 0px;\"><\/div><\/div> <\/div>    <p>\u201cWe are addressing the symptom but not the disease,\u201d he said.<\/p>    <p>In most cases, the cybersecurity law falls short of requiring unified standards across the government, said a former government IT employee, who asked not be named because he feared professional repercussions. That lack of a single set of standards has allowed agencies to decide on their own how they protect personal data.<\/p>    <p>Garc\u00eda explained that, as part of CRIM\u2019s security measures, the agency uses passwords, usernames and text messages to validate identity. He denied that anyone could access the Catastro Digital database without a password except to conduct individual searches through the public website.<\/p>    <p>The ability to access Social Security numbers through CRIM\u2019s property map raises concerns given the proliferation of private companies that sell Puerto Rico real estate information, obtained from public databases such as Catastro Digital. Any of those companies could have accessed the data, including personal information.<\/p>    <p>At least three property listings companies contacted by CPI and ProPublica said they were not aware of any vulnerability and did not access the sensitive data.<\/p> <\/div>   <aside class=\"wp-block-query is-layout-flow wp-block-query-is-layout-flow\"> <h2 class=\"wp-block-heading screen-reader-text\">Corrections<\/h2>  <\/aside>    <aside class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\"> <\/aside> <\/div>    <footer class=\"wp-block-group entry-footer is-layout-flow wp-block-group-is-layout-flow\">   <div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">  <\/div>    <div class=\"wp-block-group is-content-justification-right is-nowrap is-layout-flex wp-container-core-group-is-layout-95163ec0 wp-block-group-is-layout-flex\" style=\"border-top-color:var(--p-dyn-color-gray-01);border-top-width:1px;padding-top:var(--wp--preset--spacing--p-spacing-3)\"><div class=\"taxonomy-pp_topic hide-print wp-block-post-terms wp-container-content-9cfa9a5a\"><span class=\"wp-block-post-terms__prefix\">Filed under \u2014 <\/span><a href=\"https:\/\/maxinefilmes.com\/odelator\/\" rel=\"tag\">Technology<\/a><\/div>  <div class=\"wp-block-propublica-republish-link\" data-component=\"republish-link\">  <div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\"> <div class=\"wp-block-button is-style-outline is-style-outline--5\"><button type=\"button\" class=\"wp-block-button__link wp-element-button wp-block-propublica-republish-link__open-button\">Republish This Story<\/button><\/div> <\/div>  <div class=\"wp-block-propublica-republish-link__modal wp-block-propublica-republish-link__modal--hidden\" role=\"dialog\" aria-modal=\"true\" aria-hidden=\"true\" aria-labelledby=\"propublica-republish-link-label3\" aria-description=\"propublica-republish-link-description4\">  <div class=\"wp-block-propublica-republish-link__modal__header\"> <button type=\"button\" class=\"wp-block-propublica-republish-link__close-button\" aria-label=\"Close\"> <svg aria-hidden=\"true\" focusable=\"false\" width=\"24\" height=\"24\"><use href=\"#am-symbol-close\"><\/use><\/svg>\t<\/button> <\/div> <div class=\"wp-block-propublica-republish-link__modal__content\">  <div class=\"wp-block-propublica-republish-link__modal__instructions\"> <h2 class=\"wp-block-propublica-republish-link__modal-hed\" id=\"propublica-republish-link-label3\">Republish This Story for Free<\/h2>  <p class=\"wp-block-propublica-republish-link__modal-license\" id=\"propublica-republish-link-description4\"><a rel=\"license\" href=\"#\" data-broken-external-link=\"true\">Creative Commons License (CC BY-NC-ND 3.0)<\/a><\/p>  <hr>  <p> Thank you for your interest in republishing this story. You are free to republish it so long as you do the following:\t<\/p>  <ul> <li> You have to credit <em>ProPublica and any co-reporting partners<\/em>. In the byline, we prefer &#8220;Author Name, Publication(s).&#8221; At the top of the text of your story, include a line that reads: &#8220;This story was originally published by ProPublica.&#8221; You must link the word &#8220;ProPublica&#8221; to the original URL of the story.\t\t<\/li>  <li> If you&#8217;re republishing online, you must link to the URL of this story on propublica.org, include all of the links from our story, including our newsletter sign up language and link, and use our <a href=\"\/pixelping\">PixelPing tag<\/a>.\t\t<\/li>  <li> If you use canonical metadata, please use the ProPublica URL. For more information about canonical metadata, <a href=\"#\" data-broken-external-link=\"true\">refer to this Google SEO link<\/a>.\t\t<\/li>  <li> You can&#8217;t edit our material, except to reflect relative changes in time, location and editorial style. (For example, &#8220;yesterday&#8221; can be changed to &#8220;last week,&#8221; and &#8220;Portland, Ore.&#8221; to &#8220;Portland&#8221; or &#8220;here.&#8221;)\t\t<\/li>  <li> You cannot republish our photographs or illustrations without specific permission. Please contact <a href=\"mailto:mediarights@propublica.org\">mediarights@propublica.org<\/a>.\t\t<\/li>  <li> It&#8217;s okay to put our stories on pages with ads, but not ads specifically sold against our stories. You can&#8217;t state or imply that donations to your organization support ProPublica&#8217;s work.\t\t<\/li>  <li> You can&#8217;t sell our material separately or syndicate it. This includes publishing or syndicating our work on platforms or apps such as Apple News, Google News, etc.\t\t<\/li>  <li> You can&#8217;t republish our material wholesale, or automatically; you need to select stories to be republished individually. (To inquire about syndication or licensing opportunities, contact <a href=\"mailto:licensing@propublica.org\">licensing@propublica.org<\/a>.)\t\t<\/li>  <li> You can&#8217;t use our work to populate a website designed to improve rankings on search engines or solely to gain revenue from network-based advertisements.\t\t<\/li>  <li> We do not generally permit translation of our stories into another language. <\/li>  <li> Any website our stories appear on must include a prominent and effective way to contact you.\t\t<\/li> <\/ul> <\/div>  <div class=\"wp-block-propublica-republish-link__modal__copy\"> <label> <span class=\"screen-reader-text\">HTML<\/span>  <textarea readonly=\"\" tabindex=\"-1\">&lt;h1&gt;A Puerto Rico Government Agency Exposed 1 Million Social Security Numbers&lt;\/h1&gt; &lt;p&gt;The government agency that collects property taxes in Puerto Rico inadvertently exposed the Social Security numbers of approximately 1 million people, Centro de Periodismo Investigativo and ProPublica learned.&lt;\/p&gt; &lt;p&gt;It was the latest cybersecurity lapse for the Puerto Rico government, which in the past three years has seen technology breaches interrupt government services, take websites offline and lead to citizens\u2019 personal information being published on the dark web.&lt;\/p&gt; &lt;p&gt;CPI and ProPublica became aware of the vulnerability related to the Municipal Revenue Collection Center\u2019s interactive property map, known as the Catastro Digital, and notified the agency in mid-June.&lt;\/p&gt; &lt;p&gt;The online tool provides information, such as size, boundaries, tax assessment, sale price and owner\u2019s name, for every registered property on the island.&lt;\/p&gt; &lt;p&gt;While a simple search of the map wouldn\u2019t reveal sensitive information, anyone who understands how websites request data could download unprotected personal information such as Social Security numbers without a username or password.&lt;\/p&gt; &lt;p&gt;The news organizations were able to verify the security hole and provided the agency, known by its Spanish initials, CRIM, with a detailed description of the issue that included the specific server and folders that contained the compromised data.&lt;\/p&gt; &lt;p&gt;Despite the notification, CRIM has repeatedly denied there were any problems with its system.&lt;\/p&gt; &lt;p&gt;\u201cFollowing a review of the Catastro Digital platform, it was determined that there was NO breach of confidential personal taxpayer information, as the Catastro Digital does NOT contain or display the type of information alluded to,\u201d CRIM Executive Director Javier Garc\u00eda Cintr\u00f3n said.&lt;\/p&gt; &lt;p&gt;But a few days after CPI and ProPublica contacted CRIM, the news organizations were able to see that the security holes had been patched.&lt;\/p&gt; &lt;p&gt;Garc\u00eda denied that, saying there was no need to fix any problem. A Puerto Rico law requires any entity, including government agencies, to promptly notify users if their personal information has been breached. But Garc\u00eda said the agency would not reach out to users to tell them that their Social Security numbers were potentially exposed, as \u201cno protected information was at risk.\u201d&lt;\/p&gt; &lt;p&gt;CRIM also did not notify the Puerto Rico Innovation &amp; Technology Service, known as PRITS, which oversees all government information technology systems. The government\u2019s cybersecurity protocol requires informing PRITS of \u201cany suspected security incident.\u201d&lt;\/p&gt; &lt;p&gt;A PRITS spokesperson declined to answer questions and said they had to be submitted under Puerto Rico\u2019s public information law, which is meant to allow citizens to get government records and not to answer press questions.&lt;\/p&gt; &lt;p&gt;So far this year, more than 2 million attempted cyberattacks have been recorded within the Puerto Rico government, PRITS data shows. Half of these were deemed critical incidents, which involve \u201csevere impact on critical operations, the compromise of sensitive data, or an imminent threat to agency security or government data,\u201d according to the agency.&lt;\/p&gt; &lt;p&gt;In March, citizens saw their driver\u2019s license and registration appointments postponed after an attempted cyberattack on Transportation Department systems. Last year, Puerto Rico residents could not verify their criminal record status, which they need for employment, for almost a week because of an \u201cunauthorized access\u201d to the local Justice Department\u2019s criminal records database. In 2023, Puerto Rico water utility clients and employees saw their personal information published on the dark web after a ransomware attack.&lt;\/p&gt; &lt;p&gt;An increase in attacks prompted Puerto Rico lawmakers in 2024 to approve a comprehensive cybersecurity law, Act 40, which mandated all government agencies implement minimum cybersecurity standards and principles. It also established penalties for noncompliance and required all government agencies to conduct a risk assessment at least once annually.&lt;\/p&gt; &lt;p&gt;But three cybersecurity experts said agencies have failed to fully implement the security standards set out under the law, even as attacks become more frequent and sophisticated. Instead of periodically assessing and tackling vulnerabilities that prevent these attacks, agencies are reactive, they said.&lt;\/p&gt; &lt;p&gt;A Puerto Rico Inspector General Office report released late last year found deficiencies across 90 local government agencies, with 60% of them failing to conduct vulnerability assessments of their IT systems.&lt;\/p&gt; &lt;p&gt;The government would be in \u201cmuch better shape\u201d if it focused on employee training and implemented tools like multifactor authentication on the front end, said Carlos P\u00e9rez, a cybersecurity expert in Puerto Rico who is director of security intelligence at TrustedSec, a company that consults with governments and private companies.&lt;\/p&gt; &lt;p&gt;\u201cWe are addressing the symptom but not the disease,\u201d he said.&lt;\/p&gt; &lt;p&gt;In most cases, the cybersecurity law falls short of requiring unified standards across the government, said a former government IT employee, who asked not be named because he feared professional repercussions. That lack of a single set of standards has allowed agencies to decide on their own how they protect personal data.&lt;\/p&gt; &lt;p&gt;Garc\u00eda explained that, as part of CRIM\u2019s security measures, the agency uses passwords, usernames and text messages to validate identity. He denied that anyone could access the Catastro Digital database without a password except to conduct individual searches through the public website.&lt;\/p&gt; &lt;p&gt;The ability to access Social Security numbers through CRIM\u2019s property map raises concerns given the proliferation of private companies that sell Puerto Rico real estate information, obtained from public databases such as Catastro Digital. Any of those companies could have accessed the data, including personal information.&lt;\/p&gt; &lt;p&gt;At least three property listings companies contacted by CPI and ProPublica said they were not aware of any vulnerability and did not access the sensitive data.&lt;\/p&gt; &lt;link rel=&#8221;canonical&#8221; href=&#8221;https:\/\/www.propublica.org\/article\/puerto-rico-crim-data-breach&#8221; \/&gt; &lt;meta name=&#8221;syndication-source&#8221; content=&#8221;https:\/\/www.propublica.org\/article\/puerto-rico-crim-data-breach&#8221; \/&gt; &lt;script type=&#8221;text\/javascript&#8221; src=&#8221;https:\/\/pixel.propublica.org\/pixel.js&#8221; async&gt;&lt;\/script&gt; <\/textarea>\t<\/label>  <button type=\"button\" class=\"wp-block-propublica-republish-link__copy-button\">Copy HTML<\/button> <\/div> <\/div> <\/div> <\/div> <\/div>   <\/footer> <\/article> ","protected":false},"excerpt":{"rendered":"Illustration by Shoshana Gordon\/ProPublica A Puerto Rico Government Agency Exposed 1 Million Social Security Numbers A cybersecurity loophole in an official government mapping service left private data easily accessible, Centro de Periodismo Investigativo and ProPublica learned. by Luis Valent\u00edn, Centro de Periodismo Investigativo, and Nick McMillan, ProPublica Co-published with Centro de Periodismo Investigativo July 9, [&hellip;]","protected":false},"author":1,"featured_media":118,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-117","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciencia-tecnologia-e-inovacao"],"_links":{"self":[{"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/posts\/117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/comments?post=117"}],"version-history":[{"count":2,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/posts\/117\/revisions"}],"predecessor-version":[{"id":293,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/posts\/117\/revisions\/293"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/media\/118"}],"wp:attachment":[{"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/media?parent=117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/categories?post=117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/maxinefilmes.com\/odelator\/wp-json\/wp\/v2\/tags?post=117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}