POPULAR, INC.

Item 8.01. Other Events. On May 15, 2026, Popular, Inc. (the “Corporation”) was notified by Evertec, Inc. (“Evertec”), a third-party core financial transaction processing and information technology services provider of the Corporation, that Evertec had experienced a cybersecurity incident affecting certain data of its clients, including that of Banco Popular de Puerto Rico (“BPPR”), the Corporation’s Puerto Rico banking subsidiary. Subsequent to its initial notification, Evertec notified the Corporation that it had identified additional data from BPPR that had been compromised. Based on information gathered to date, the affected data includes personal information of certain BPPR customers, including debit card numbers and certain other information. The Corporation is assessing the situation closely with Evertec and has implemented enhanced fraud monitoring measures to further protect its customers. The Corporation has a contractual right to be covered by Evertec for losses resulting from, and reasonable and customary costs and expenses related to, the incident. The Corporation promptly initiated its cybersecurity incident response protocols and has notified applicable regulators. Affected customers will be notified directly, as appropriate. The Corporation’s systems were not accessed in or otherwise affected by this incident. Based on the information currently available, the Corporation does not believe that the incident is reasonably likely to have a material impact on the Corporation’s operations, financial condition or results of operations. Cautionary Note Regarding Forward-Looking Statements This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the U.S. Private Securities Litigation Reform Act of 1995, including statements rega