Puerto Rico Agency Says Exposed Data Did Not Include Social Security Numbers

The Municipal Revenue Collection Center inadvertently exposed the Social Security numbers of approximately 1 million people through its Catastro Digital interactive property map, ProPublica reported. The online tool displays property size, boundaries, tax assessment, sale price and owner’s name for every registered property in Puerto Rico.

Users without a username or password could download the numbers by crafting data requests to the server.

CPI and ProPublica discovered the vulnerability and notified the agency in mid-June 2026. A few days later the security holes were patched. CRIM Executive Director Javier García Cintrón stated there was no breach because the platform does not contain or display confidential personal taxpayer information.

García Cintrón denied that any fix was implemented and said the agency would not notify affected users because no protected information was at risk. Puerto Rico law requires prompt notification of any breach of personal information. CRIM also did not notify the Puerto Rico Innovation & Technology Service as required by protocol for any suspected security incident.

More than 2 million attempted cyberattacks have been recorded against Puerto Rico government systems so far in 2026, with half deemed critical incidents. Earlier incidents include postponed driver’s license appointments in March 2026 after an attack on the Transportation Department, an unauthorized access to the Justice Department criminal-records database in 2025, and a 2023 ransomware attack that published water-utility client and employee data on the dark web.

Lawmakers approved Act 40 in 2024 to set minimum cybersecurity standards and require annual risk assessments.