# EDGAR Filing Document

**Accession Number:** 0000763901
**File Stem:** 0001193125-26-263044
**Filing Date:** 2026-6
**Character Count:** 7420
**Document Hash:** f1df5d2606759c19aa0897059f0a5bf9
**Contains OCR:** False
**Source Format:** 

## Filing Content

## Filing Summary
**0001193125-26-263044.hdr.sgml**: 20260609

**ACCESSION NUMBER**: 0001193125-26-263044

**CONFORMED SUBMISSION TYPE**: 8-K

**PUBLIC DOCUMENT COUNT**: 12

**CONFORMED PERIOD OF REPORT**: 20260609

**ITEM INFORMATION**: Other Events

**FILED AS OF DATE**: 20260609

**DATE AS OF CHANGE**: 20260609

**FILER**: 

**COMPANY DATA:**
- **COMPANY CONFORMED NAME:** POPULAR, INC.
- **CENTRAL INDEX KEY:** 0000763901
- **STANDARD INDUSTRIAL CLASSIFICATION:** STATE COMMERCIAL BANKS [6022]
- **ORGANIZATION NAME:** 02 Finance
- **EIN:** 660667416
- **FISCAL YEAR END:** 1231

**FILING VALUES:**
- **FORM TYPE:** 8-K
- **SEC ACT:** 1934 Act
- **SEC FILE NUMBER:** 001-34084
- **FILM NUMBER:** 261074676

**BUSINESS ADDRESS:**
- **STREET 1:** 209 MUNOZ RIVERA AVE
- **STREET 2:** POPULAR CENTER BUILDING
- **CITY:** HATO REY
- **STATE:** PR
- **ZIP:** 00918
- **BUSINESS PHONE:** 7877659800

**MAIL ADDRESS:**
- **STREET 1:** P.O. BOX 362708
- **CITY:** SAN JUAN
- **STATE:** PR
- **ZIP:** 00936-2708

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** POPULAR INC
- **DATE OF NAME CHANGE:** 19970428

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** BANPONCE CORP
- **DATE OF NAME CHANGE:** 19920703

?xml version='1.0' encoding='ASCII'? 8-K

### UNITED STATES

### SECURITIES AND EXCHANGE COMMISSION

#### Washington, D.C. 20549

### Form 8-K

#### CURRENT REPORT

#### Pursuant to Section 13 OR 15(d)

#### of the Securities Exchange Act of 1934

#### Date of Report (Date of earliest event reported): June 9, 2026

## POPULAR, INC.

#### (Exact name of registrant as specified in its charter)

---

| | | |
|:---|:---|:---|
| **Puerto Rico** | **001-34084** | **66-0667416** |
| **(State or other jurisdiction of**<br> **incorporation or organization)** | **(Commission**<br> **File Number)** | **(IRS EmployerIdentification Number)** |

---

---

| | |
|:---|:---|
| **209 Muñoz Rivera Avenue**<br> **Hato Rey, Puerto Rico** | **00918** |
| **(Address of principal executive offices)** | **(Zip code)** |

---

(787) 765-9800

#### (Registrant's telephone number, including area code)

#### NOT APPLICABLE

#### (Former name, former address and former fiscal year, if changed since last report)
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions (*see* General Instruction A.2. below):

☐ Written communication pursuant to Rule 425 under the Securities Act (17 CFR 230.425)

☐ Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)

☐ Pre-commencement communication pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))

☐ Pre-commencement communication pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

Securities registered pursuant to Section 12(b) of the Act:

---

| | | |
|:---|:---|:---|
| **Title of each class** | **Trading<br>Symbol(s)** | **Name of each exchange<br>on which registered** |
| Common Stock ($0.01 par value) | BPOP | The NASDAQ Stock Market |
| 6.125% Cumulative Monthly Income Trust Preferred Securities | BPOPM | The NASDAQ Stock Market |

---

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

------

---

| | |
|:---|:---|
| **Item 8.01.** | **Other Events.**  |

---

On May 15, 2026, Popular, Inc. (the "Corporation") was notified by Evertec, Inc. ("Evertec"), a third-party core financial transaction processing and information technology services provider of the Corporation, that Evertec had experienced a cybersecurity incident affecting certain data of its clients, including that of Banco Popular de Puerto Rico ("BPPR"), the Corporation's Puerto Rico banking subsidiary. Subsequent to its initial notification, Evertec notified the Corporation that it had identified additional data from BPPR that had been compromised. Based on information gathered to date, the affected data includes personal information of certain BPPR customers, including debit card numbers and certain other information. The Corporation is assessing the situation closely with Evertec and has implemented enhanced fraud monitoring measures to further protect its customers. The Corporation has a contractual right to be covered by Evertec for losses resulting from, and reasonable and customary costs and expenses related to, the incident.

The Corporation promptly initiated its cybersecurity incident response protocols and has notified applicable regulators. Affected customers will be notified directly, as appropriate.

The Corporation's systems were not accessed in or otherwise affected by this incident.

Based on the information currently available, the Corporation does not believe that the incident is reasonably likely to have a material impact on the Corporation's operations, financial condition or results of operations.

#### Cautionary Note Regarding Forward-Looking Statements
This Current Report on Form 8-K contains "forward-looking statements" within the meaning of the U.S. Private Securities Litigation Reform Act of 1995, including statements regarding the Corporation's current expectations regarding the cybersecurity incident and its impacts. These statements are based on management's current expectations and, by their nature, involve risks and uncertainties. Potential factors, some of which are beyond the Corporation's control, could cause actual results to differ materially from those expressed in, or implied by, such forward-looking statements. Risks and uncertainties include, without limitation, the results of Evertec's analysis of the scope and details of the cybersecurity incident and the discovery of new or additional information; any potential adverse impact of the cybersecurity incident on the Corporation's operations, financial condition or results of operations; diversion of management's attention from operations of the Corporation to address the cybersecurity incident; potential adverse effects on relationships with customers and other third parties as a result of the cybersecurity incident; regulatory scrutiny of the cybersecurity incident; risks related to the availability of the cost and expense reimbursement and insurance coverage; and other risks described in Part I, Item 1A: Risk Factors included in the Corporation's Annual Report on Form 10-K for the year ended December 31, 2025 and other reports on file with the Securities and Exchange Commission.

------

#### SIGNATURE
Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

---

| | | |
|:---|:---|:---|
|  | **<u>POPULAR, INC.</u>**<br> (Registrant) | **<u>POPULAR, INC.</u>**<br> (Registrant) |
| Date: June 9, 2026 | By: | **/s/ José R. Coleman Tió** |
|  |  | José R. Coleman Tió |
|  |  | Executive Vice President and Chief Legal Officer |

---