Puerto Rico — Cyber Threat Profile

Puerto Rico, a US territory, falls under CISA and FBI federal cyber coverage while operating its own territorial authority, the Puerto Rico Innovation and Technology Service (PRITS). Act 40-2024, the Puerto Rico Cybersecurity Act, imposes minimum cybersecurity standards on executive-branch entities and contractors, including 48-hour incident disclosure, and a CISA-approved plan channels over $12.6 million in federal SLCGP funding through PRITS. The public sector is the dominant target: a 2020 phishing scam cost the Industrial Development Company over $2.6 million, Vice Society ransomware hit water utility PRASA in 2023, a May 2025 cyberattack forced the Justice Department to suspend criminal-record services, and in 2026 the CRIM property-tax agency exposed roughly one million Social Security numbers. Grid operator LUMA Energy also weathered a major DDoS attack in June 2021.

Threat actors targeting Puerto Rico

Most targeted sectors

Recent claimed incidents

Read the full analysis on IntelFusions