Puerto Rico Department of Justice
Puerto Rico Department of Justice cyberattack
Summary
A May 2025 cyberattack disrupted Puerto Rico’s criminal-information system and suspended background-certificate services. Core platforms were reported restored June 5, while later licensing and federal-connection problems require separate qualification.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
A cybersecurity incident disrupted Puerto Rico’s Criminal Justice Information System, SIJC-PR, in late May 2025, interrupting criminal-record certificates and information used by justice and law enforcement agencies. InDiario’s May 30 report placed the initial outage that Monday, May 26, and quoted a source describing systems unavailable by Tuesday. The precise technical onset has not been independently established. That report initially treated a cyberattack as suspected, before the government’s acknowledgment.
The Department of Justice and the Puerto Rico Innovation and Technology Service acknowledged the incident in a May 30 agency statement reproduced by InDiario. It said services, including criminal-record certificates, had been suspended while teams contained and investigated the incident. PRITS’ Office of Cyber Incident Evaluation supported the response. Our initial report followed June 3. The governor’s June 5 statement subsequently confirmed unauthorized access to SIJC-PR.
Operational significance
The incident affected a shared government information service, extending beyond the department’s headquarters in San Juan. The initial local report described effects on prosecutors, police, corrections and other users, with prosecutors filing cases manually. Primera Hora’s May 31 account corroborated the suspension of criminal-record certificates and the coordinated response. These are documented service and workflow effects; the evidence does not establish a compromise of every connected agency’s own network.
On June 5, the governor announced that the information systems had been restored, including the background-certificate service, and said citizens should again be able to access the platforms. Officials described additional security controls, testing and monitoring, while saying state and federal investigations continued. This establishes a core-platform restoration milestone rather than the completion of every associated administrative process.
Later reporting identified a narrower continuing problem. In Metro’s July 9 report, the license-holder association CODEPOLA attributed obstacles to firearm-license applications and renewals to the Justice system incident and requested an extension. The association’s account supports a reported downstream disruption, but does not establish that all SIJC platforms remained continuously offline after June 5.
An Aug. 11 executive order extended affected licenses while the National Crime Information Center connection and required background checks remained interrupted. The governor’s accompanying explanation attributed the disconnection to technical adjustments needed to improve integration of the criminal registry with the federal system. The order confirms the later connection problem, but does not expressly establish that the May intrusion caused it. These sources are retained to distinguish that problem from the earlier restoration announcement.
Confidence and uncertainty
Confidence is high that SIJC-PR experienced unauthorized access and a consequential service suspension. The governor asserted June 5 that citizens’ information had not been compromised. That is the government’s stated assessment; no independently reviewed forensic report establishes which systems or data an intruder accessed. System unavailability is documented, while theft, alteration and publication of criminal records remain unverified.
No reviewed source identifies ransomware deployment, a ransom demand, a responsible group or payment. Searches under the department’s English and Spanish names, its website domain, the criminal-information domain and SIJC abbreviations returned no matching ransomware claim. The response organizations are not treated as additional victims solely because they assisted with containment and recovery.
Analytic gaps
The initial access method, intrusion timeline, data-access scope, affected transaction count, delayed-case count and total costs remain unresolved. Core platforms were reported restored June 5; the relationship between the later federal-interface interruption and the May intrusion remains uncertain, and no final reconnection or backlog-clearance date was established in this pass. The event is assessed as presumed resolved, with the July 9 licensing account retained as the latest reported downstream effect and no exact overall end date assigned.
Organizations involved
Impacted locations
Puerto Rico
The disrupted SIJC platform and background-certificate service support users across Puerto Rico. The evidence does not establish that every territorial agency’s own infrastructure was compromised.
San Juan, Puerto Rico
San Juan identifies the department’s headquarters and SIJC administrative offices. The shared territorial service interruption is represented separately by the Puerto Rico impacted-area relationship.
Sources
Initial report describes the criminal-information system disruption and suspended background-certificate services.
The department and PRITS acknowledged a cybersecurity incident in SIJC-PR and suspended services including criminal-record certificates while containing and investigating it.
Sources reported an outage beginning that Monday, manual case filing and unavailable criminal-record services across agencies.
The department’s notice issued the previous night described suspended services and coordinated containment with PRITS and its cyber incident office.
The governor confirmed unauthorized access and announced restoration of the criminal-information platforms, including criminal-record certificates; investigations continued.
A license-holder association said citizens still faced renewal and application obstacles after the Justice system incident and requested an extension.
The order extends licenses that expired from May 25 while the NCIC connection and background checks remain interrupted.
The governor’s statement confirms the NCIC interruption and says technical adjustments were needed to improve integration with the criminal registry.
See something that needs correction?
Signed-in members can report an error, update, or missing source.