Breach taxonomy
Summary
EVERTEC learned on May 13, 2026 of unauthorized access to customer data. An unauthorized party obtained, through a third-party support platform, financial institution clients' information including transaction records, payment card numbers and in some cases customer names and contact information, primarily affecting financial institution clients in Puerto Rico and their customers. EVERTEC contained the incident and believes the unauthorized party no longer has access. Filed under Item 8.01; materiality not determined as a 1.05 incident.
Tagging rationale
ThreatUnknown
Filing refers only to 'an unauthorized party' with no attribution -> UNKNOWN.
MethodsData ExfilSupply Chain
An unauthorized party 'obtained, through a third-party support platform,' client data -> DATA-EXFIL + SUPPLY-CHAIN.