Popular, Inc. Reports Cybersecurity Incident Affecting Subsidiary’s Customer Data
Key Points:
- Date of report: June 9, 2026
- Incident: Cybersecurity breach at third-party provider Evertec, Inc., impacting Banco Popular de Puerto Rico (BPPR), a subsidiary of Popular, Inc.
- Data affected: Personal information of certain BPPR customers, including debit card numbers and unspecified additional information.
- Company Response: Popular, Inc. is actively assessing the incident with Evertec and has implemented measures to address and mitigate related risks.
- Material Impact: As of now, Popular, Inc. does not believe the incident is likely to have a material impact on its operations, financial condition, or results.
- Ongoing Risks: The company cautions there could be future developments or findings that may lead to a different assessment.
Detailed Report
On June 9, 2026, Popular, Inc., a leading Puerto Rican financial institution and the parent company of Banco Popular de Puerto Rico (BPPR), filed a Form 8-K to disclose a cybersecurity incident that occurred at Evertec, Inc., its third-party core financial transaction processing and information technology services provider.
According to the filing, Popular was first notified by Evertec on May 17, 2026, of a cybersecurity breach that compromised certain customer data belonging to BPPR. After the initial notification, Evertec informed Popular, Inc. that further BPPR customer data had also been found to be compromised. The affected data includes personal information of certain BPPR customers, notably debit card numbers, as well as unspecified “certain other information.”
Popular, Inc. emphasized that, based on information available at this time, the company’s internal systems were not accessed or otherwise affected by the incident. The corporation is working closely with Evertec to fully assess the situation and has implemented measures to address and mitigate risks associated with the breach.
Shareholder and Investor Considerations:
- Potential Impact: The company stated that, at present, it does not believe the cybersecurity incident is reasonably likely to have a material impact on its operations, financial condition, or future results. However, this assessment could change as more information becomes available.
- Forward-Looking Risks: Popular, Inc. highlighted several risks and uncertainties that could affect this assessment, including:
- The ongoing analysis by Evertec regarding the scope and details of the cybersecurity incident;
- The possibility that new or additional information about the incident may emerge;
- Potential adverse impacts on operations, financial condition, or results of operations if the situation escalates;
- Potential damage to customer and third-party relationships;
- Regulatory scrutiny and compliance risks related to the incident;
- Questions regarding the adequacy of cost and expense reimbursement and insurance coverage.
- Management Attention: Addressing the breach may divert management attention from other operational priorities.
The company concluded its disclosure with a standard forward-looking statement, warning that actual results could differ materially from current expectations due to factors both within and outside the company’s control. Shareholders are advised to review Popular, Inc.’s annual and other periodic reports filed with the SEC for a comprehensive discussion of risk factors.
Potential Market Sensitivity
While Popular, Inc. currently believes the incident will not materially affect its operations or financial results, the exposure of customer data, including sensitive debit card numbers, could have reputational and regulatory consequences if further risks materialize. Investors should monitor ongoing updates closely, as any change in the company’s risk assessment or the discovery of broader impacts could be price sensitive and influence share value.
Disclaimer: This article summarizes material events as reported by Popular, Inc. in its June 9, 2026 Form 8-K filing. The information provided does not constitute investment advice. Investors should consult official filings and seek professional advice before making investment decisions. Forward-looking statements are subject to change and actual results may differ materially from those anticipated.
