In October 2025, the National Center for Missing and Exploited Children received a CyberTip from WhatsApp, Inc. The CyberTip reported that one suspected file of child sexual abuse material (“CSAM”) was uploaded on October 1, 2025, at 5:37:50 UTC. The Minnesota Bureau of Criminal Apprehension obtained subscriber information for the phone number associated with the relevant WhatsApp account. That information revealed that the account owner of the phone number lived in Bloomington, Hennepin County, Minnesota.
An investigator reviewed the CSAM file from the CyberTip, which was an 86-second video showing a prepubescent female child with her legs open and an adult male rubbing his erect penis on the child’s genitals and inserting it into the child’s genitals. Based on the child’s size and development, the investigator estimated that she was under age five. The same phone number was also involved in a CyberTip from August 8, 2024. That CyberTip involved the uploading of two suspected CSAM files to Instagram.
Law enforcement investigated that tip and identified the suspect as HUGO LEON CENTENO, born on [DOB REDACTED], Defendant herein. During that case, investigators interviewed Defendant and learned from him that he had exchanged the CSAM between his two Instagram accounts. Defendant also admitted to purchasing CSAM on Telegram. Investigators educated Defendant and his mother about the potential legal matter and declined to send the case for a charging decision. An investigator reviewed historical records from a law enforcement database that listed Defendant’s name with the phone number from the above CyberTips.
On December 16, 2025, law enforcement executed a search warrant at a Bloomington residence associated with Defendant. Before doing so, law enforcement confirmed with building management that Defendant was listed as a person living in an apartment there. In addition, Defendant’s mother confirmed that he had moved out of a prior residence in September and lives in a Bloomington apartment. Upon executing the search warrant, officers encountered Defendant and arrested him. During execution of the warrant, officers seized (1) a white PC tower; (2) three iPhones; (3) a 32-GB SD card; (4) a 32-GB MicroSD card; (5) a laptop; and (6) an iPad.
In a Miranda statement, Defendant acknowledged moving into his current residence in September. Defendant provided his phone number, which matched the number from the CyberTips. In addition, Defendant identified “the gold” iPhone as the device that he primarily uses. When asked whether he stores any data or files on external hard drives, Defendant answered yes. He explained that he had three SD cards and that two of them were for “what I’m being arrested for.” When asked what he believed he was being arrested for, Defendant replied “child pornography.” Defendant confirmed that officers would find CSAM on the SD cards and on his cell phone, estimating that these devices contained 50 gigabytes of CSAM files.
