FEDERALItem 8.01 · voluntaryHackingTechnologyInformationSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Financial accountMediumContained

EVERTEC, Inc.

bd_ada47398c7bb9c01 · schema v1 · pii pii-v2

Severity

Medium

Discovered

May 13, 2026

Filed

Jun 9, 2026

To disclose

27 days

Affected

Not disclosed

Confidence

68%

Full breach record for EVERTEC, Inc. →

Evertec, Inc. (CIK 0001559865) disclosed on June 9, 2026, that it learned on May 13, 2026, of unauthorized access to customer data via a third-party support platform. The incident primarily affected financial institution clients in Puerto Rico and their customers, exposing transaction records, payment card numbers, names, and contact info. Evertec notified law enforcement and engaged external experts. The investigation is ongoing, and the full scope of affected individuals is undetermined.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 days

May 13, 2026

Discovered

Jun 9, 2026

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: EVERTEC, Inc.
norm: evertec
SEC CIK: 0001559865
Domain: evertecinc.com

Name: EVERTEC, Inc.
norm: evertec
SEC CIK: 0001559865
Domain: evertecinc.com
Industry: Technologynaics map

Discovered: May 13, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via third-party support platform
Initial access: supply_chain

During the incident: Initiated its cyber incident response protocols
Notified federal law enforcement authorities
Engaged external cybersecurity experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1559865/000155986526000039/evtc-20260609.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 9, 2026
Raw hash: 603c541cea09a250ee92019a902167ce0cda7538c2e67a123bdb1d69ee1ee2cc

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html31.9 KB

Download View at source

Reporting entityEVERTEC, Inc.

Victim entityEVERTEC, Inc.

Incidentdiscovered May 13, 2026

Stated responseInitiated its cyber incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing