Cybersecurity Incident at Evertec Impacts Banco Popular de Puerto Rico Customer Data On May 15, 2026, Popular, Inc. disclosed that its third-party financial transaction processor, Evertec, Inc., experienced a cybersecurity breach affecting data belonging to clients, including Banco Popular de Puerto Rico (BPPR), the company’s Puerto Rico-based banking subsidiary. The incident initially involved compromised customer data, with later findings revealing additional exposed information, such as debit card numbers and other personal details. Popular, Inc. confirmed that its own systems remained unaffected but has collaborated with Evertec to assess the scope of the breach. Enhanced fraud monitoring measures have been implemented to protect customers, and affected individuals will be notified directly. Regulatory authorities have been informed as part of the company’s incident response protocols. While the breach originated at Evertec, Popular, Inc. holds contractual protections for losses and related expenses stemming from the incident. The company currently does not anticipate a material impact on its operations, financial condition, or results, though ongoing investigations may uncover further details. Risks remain, including potential regulatory scrutiny, customer relationship impacts, and management resource diversion as the situation develops.

The Maine Attorney General's Office reported a data breach involving Banco Popular de Puerto Rico on August 14, 2023. The breach occurred on July 24, 2023, affecting a total of 82,217 individuals, with 4 residents specifically impacted. The breach involved a vendor incident that potentially compromised Social Security Numbers, and identity theft protection services were offered for 24 months through Equifax.