Company: BPOPM
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001193125-25-043848
Chunk: 43

Company: POPULAR, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 43
---

information
or
that
of
our
clients,
customers,
counterparties
or 
employees, or
other negative
implications identified
above with
respect to
a cyber-attack
on our
systems. The
most important
of 
these
third-party service
providers for
us
is
Evertec. As
a result,
we
depend on
Evertec to
identify and
remediate certain
of
our 
cybersecurity vulnerabilities. Cyber-attacks at third-party service
providers are also becoming increasingly common, and,
as a result, 
cybersecurity risks relating to our vendors, including Evertec have increased.
Certain risks particular to Evertec and our dependence 
on
third
parties
are
discussed
under
“We
rely
on
other
companies
to
provide
key
components
of
our
business
infrastructure, 

  28 
including certain of our core financial transaction processing and
information technology and security services, which exposes us to 
a number
of operational
risks that
could have
a material
adverse effect
on us”
in the
Operational Risks
section of
Item 1A
in this 
Form 10-K.
During 2021,
we determined that,
as a
result of
the widely
reported breach of
Accellion, Inc.’s
File Transfer
Appliance 
tool, which
was being
used at
the time
of such
breach by
a U.S.-based
third-party advisory
services vendor
of Popular,
personal 
information
of
certain
Popular
customers
was
compromised.
During
2023,
personal
information of
Popular
customers’
data
was 
compromised
in
a
data
breach
incident
that
impacted
MOVEit,
the
third-party
file
transfer
platform
used
by
one
of
our
service 
providers. In both instances, Popular notified,
as required or otherwise deemed appropriate, customers identified
as affected by the 
incident. Furthermore,
during 2024,
threat actors
exploited a
zero-day vulnerability
in the
Fortinet enterprise
management server 
software
used
by
Evertec,
which
migrated
to
one
of
Popular's
domain
controllers
due
to
a
shared
network
environment