POPULAR, INC.

Popular, Inc. filed an 8-K on June 9, 2026, disclosing a cybersecurity incident at Evertec, Inc., a third-party service provider, affecting data of Popular's Puerto Rico banking subsidiary, Banco Popular de Puerto Rico (BPPR). The compromised data included BPPR customer debit card numbers and other personal information. Popular's own systems were not accessed. The company has implemented enhanced fraud monitoring and notified regulators.

Banco Popular de Puerto Rico (BPPR) reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-04-16. 4 Massachusetts residents were affected.

Banco Popular de Puerto Rico notified the NH Attorney General of a third-party breach involving its auditor, PwC. PwC's MOVEit software was compromised, exposing personal information (names, SSNs, etc.) of 12 NH residents. Popular discovered the incident on July 24, 2023, and began notifying residents on August 7, 2023, offering two years of credit monitoring.

Banco Popular de Puerto Rico reported a data breach affecting 4 Maine residents, which was discovered on July 24, 2023. The breach occurred on the same day and was attributed to a vendor incident. The compromised information includes names and Social Security Numbers. The bank is offering 24 months of complimentary credit monitoring services through Equifax to the affected individuals.

Banco Popular de Puerto Rico reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-11. 207 Massachusetts residents were affected. The report records the breach type as electronic.

Banco Popular de Puerto Rico notified customers that PwC, its auditor, suffered a MOVEit transfer software breach. PwC's investigation on July 24, 2023, confirmed customer data (name, SSN, mortgage info) was compromised. Popular is offering two years of Equifax credit monitoring.