CRIM left about one million Social Security numbers downloadable; García Cintrón denies it

On July 9, 2026, at 6:00 a.m., the Centro de Periodismo Investigativo reports, by Luis Valentín and Nick McMillan of ProPublica, that CRIM's Digital Cadastre left Social Security numbers of about one million people downloadable, with no username or password. CPI and ProPublica notified in mid-June. Javier García Cintrón, CRIM executive director, denied the vulnerability in writing: the Cadastre «NO contiene, ni muestra» that information. Days later, the flaw was patched. García denied the fix and said he would not notify users.

CRIM did not tell PRITS. The protocol requires reporting any suspected incident. PRITS, as cited by CPI, puts more than two million attempted attacks in 2026, half of them critical. The Office of the Inspector General, as cited by CPI, found that 60 percent of 90 agencies had not run Act 40-2024 IT vulnerability assessments. This note does not turn the patch into a confession or the 60 percent into a María theft.

What remains is one million Social Security numbers, a denial, a patch, and a no to PRITS. A reader who wants CPI on the 9th has the URL at the foot. This is not original reporting.

Source: Centro de Periodismo Investigativo. https://periodismoinvestigativo.com/2026/07/crim-expuso-seguro-social-puerto-rico/