Cyber Incident Victim: Puerto Rico Department of Justice
Date:
May 2025
Location:
United States of America
Summary
The Puerto Rico Department of Justice experienced a cyberattack that led to the temporary suspension of several services, including the issuance of criminal background certificates. In coordination with the Puerto Rico Innovation and Technology Service and its Cyber Incident Evaluation Office, the agency activated its security protocols and is working on containment, investigation, and technical assessment of the incident. Services were halted to protect citizens' personal data, and restoration will occur only after the affected systems are certified secure and data integrity is confirmed. The department has stated that no further details will be released at this time but will provide updates when appropriate and permitted.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
A cyberattack was launched toward the Puerto Rico Department of Justice, prompting the temporary suspension of several services, including the issuance of criminal background certificates. The notice of the cyberattack was issued the previous evening. In a press release, the Department of Justice stated that it was working together with the Puerto Rico Innovation and Technology Service (PRITS) and PRITS’s Office of Cyber Incident Evaluation (OEIC) to address a cybersecurity incident affecting the Criminal Justice Information System (SIJC‑PR).
According to the release, the corresponding security protocols were activated immediately upon detection, and a joint, coordinated effort began in the containment and investigation phases of the event. The technical evaluation of the incident’s scope continues to develop with the support of the pertinent authorities. To prevent further complications, the decision was made to halt the affected services, a step justified by the department’s commitment to fully protect citizens’ personal data. The statement emphasized that the restoration of the impacted systems will occur only after the environments have been certified as safe and the integrity of the data has been guaranteed.
Immediately after the announcement, the department indicated that no additional details about the incident would be disclosed at that time. It reaffirmed its commitment to transparency, data protection, and the quality of services provided to the public, assuring citizens that all necessary processes are being undertaken with the urgency the situation requires. The department added that, as appropriate and permitted, it will update the information as the investigation progresses.