Reporting describes a ransomware incident linked to a technology contractor that affected several Puerto Rico government agencies during the week of the US Thanksgiving holiday in November 2025, with initial access obtained through compromised credentials.
The Holiday Timing Is Not A Coincidence
Deployment timed to a public holiday is a documented and long-standing pattern, for reasons that require no sophistication: reduced staffing, delayed escalation, and a longer window before anyone senior is reachable.
It appears repeatedly in this database — the weekend deployment at 26-0212, the holiday-period incidents at 26-0131. Public-sector bodies are particularly exposed because holiday coverage is thinner and because there is rarely a commercial imperative funding a night shift.
A Shared Contractor Multiplies A Single Intrusion
Multiple agencies affected through one supplier is the structure filed at 25-0824 for state agencies and at 26-0628. Government IT consolidation produces exactly this: shared infrastructure lowers cost per agency and converts one compromise into a portfolio.
And the citizen has no alternative supplier. A retailer’s customers can shop elsewhere while systems are restored; a resident who needs a permit, a licence or a benefit payment has one place to obtain it.
What We Are Not Asserting
Graded low. This file rests on limited reporting: we have not established which agencies were affected, what services were interrupted, for how long, whether data was taken, or whether the named contractor was the point of entry as opposed to a party that shared the consequence.
It is recorded because the structure is consistent with the rest of the public-sector set, and it is graded low so that it is not mistaken for something better established. If more detail emerges we will revise it.
Compiled from a limited set of public reporting, listed below. The account of the contractor’s role is as reported and is not established. Corrections: corrections@forensicpost.com.