Popular, Inc. filed an 8-K on June 9, 2026, disclosing a cybersecurity incident affecting its Puerto Rico banking subsidiary, Banco Popular de Puerto Rico (BPPR). The incident was caused by a third-party service provider, Evertec, Inc., which experienced unauthorized access to client data. The compromised data included BPPR customer debit card numbers and other personal information. Popular's own systems were not accessed. The company has implemented enhanced fraud monitoring and notified regulators.