Ransomware vs Puerto Rico municipalities: lessons from 2023–2025

Between 2023 and 2025, several municipalities in Puerto Rico and the anglophone Caribbean reported ransomware disruptions: frozen payroll systems, inaccessible permit portals, and officials coordinating response via personal Gmail. Krebs on Security has covered similar waves hitting continental local governments; the difference here is tight municipal budgets and dependence on a single IT vendor.

CISA publishes guidance specific to State, Local, Tribal, and Territorial (SLTT) entities. The core message: segmentation, offline backups, MFA on admin accounts, and citizen communication plans before an incident. None require six-figure licenses; all require stopping treatment of security as an optional line item when fiscal year-end budget remains.

The attack pattern is predictable. Phishing municipal employees, exposed RDP from a local tax software contractor, or unpatched VPN. Once inside, groups encrypt file servers and exfiltrate citizen data for double extortion. Negotiating from weakness — without tested backups — is what Brian Krebs documents as a recipe for repeat payments.

Viable controls on limited public resources: join MS-ISAC where applicable, enable EDR on office endpoints, disable macros via GPO, and run an annual tabletop with the mayor's office, legal, and press. Document which services can run on paper for 72 hours without violating legal obligations.

Citizens in San Juan, Carolina, or smaller towns deserve resilient digital services. Municipal ransomware is not inevitable; it is a symptom of decades prioritizing functionality over continuity. The good news: basic hardening in mid-size municipal environments is achievable in one fiscal quarter with targeted external technical support.