Company: BPOPM
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001193125-25-043848
Chunk: 44

Company: POPULAR, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 44
---
.
While 
Evertec determined that
no BPPR customer
information was exfiltrated
as a result
of this incident,
the event
underscores the risks 
inherent
in
Popular’s
dependency
on
Evertec.
Although
these
incidents
did
not
have
a
material
effect
on
Popular,
including
its 
business
strategy,
results
of
operations
or
financial
condition,
and
our
third-party
service
providers
agreed
to
cover
external 
remediation
costs
associated
therewith,
a
compromise
of
Popular
information
or
the
personal
information
of
our
customers 
maintained by third party
vendors could result in significant
regulatory consequences, reputational damage and financial
loss to us. 
The success
of our
business depends in
part on the
continuing ability of
these (and
other) third
parties to perform
these functions 
and
services
in
a
timely
and
satisfactory manner,
which performance
could
be
disrupted or
otherwise adversely
affected
due
to 
failures
or
other information
security
events originating
at
the
third parties
or
at
the third
parties’ suppliers
or
vendors
(so-called 
“fourth party risk”). We may not be able to effectively directly monitor or mitigate fourth-party risk, in particular as it relates to the use 
of common suppliers or vendors by the third parties
that perform functions and services for us. 

As cyber
threats continue
to evolve,
we also
expect to
expend significant
additional resources
to continue
to modify
or 
enhance
our
layers
of
defense
or
to
investigate
and
remediate
additional
information
security
vulnerabilities
or
incidents.
The 
obsolescence
in
our
hardware
or
software
limits
our
ability
to
mitigate
vulnerabilities.
System
enhancements and
updates
also 
create
risks
associated
with
implementing new
systems
and
integrating
them
with
existing
ones,
including
risks
associated
with 
supply chain compromises and the software development lifecycle of the systems used by us and our service providers. In
addition,