Evertec Data Breach Exposes Customer Data in Puerto Rico

Evertec, a financial technology company, filed an 8-K report with the SEC on June 9, 2026, confirming a data breach that potentially exposed customer data belonging to clients in Puerto Rico. The company first detected the potential compromise on May 13, 2026, originating from a third-party support platform, confirming supply chain risks for financial institutions. The incident potentially exfiltrated sensitive financial and personal information, affecting individuals who use Evertec's services through their local banks, though the full scope of data types and affected individuals has not been confirmed by Evertec.

What Happened

Evertec identified potential unauthorized access to customer data on May 13, 2026, triggering an internal investigation. The company later disclosed the incident in its June 9, 2026 SEC filing. Investigators believe a third-party support platform was the initial point of compromise. This was a dependency vulnerability, not a direct attack on Evertec's core infrastructure.

Evertec has not publicly disclosed a specific CVE ID, malware name, or threat actor linked to the breach, but the method suggests a targeted supply chain exploitation. Evertec is working with external cybersecurity experts to ascertain the full scope of the attack. Popular, one of Evertec's financial institution clients in Puerto Rico, has issued an online notification to its customers, stating that Evertec will be sending out direct notification letters to those affected. Evertec has not confirmed the full scope of data potentially exposed, but the incident could involve transaction records, payment card numbers, names, and contact details, affecting an unconfirmed number of individuals.

Why It Matters

The Evertec data breach highlights the critical and growing threat from third-party vendor compromises, particularly for financial services. This shows that security is only as strong as the weakest link, often residing with a vendor. The Verizon Data Breach Investigations Report (DBIR) 2026 indicates third parties were involved in approximately 48% of data breaches, a 60% year-over-year increase, significantly impacting sectors like healthcare. Financial institutions are similarly vulnerable.

Compromised data, especially payment card numbers and transaction records, creates avenues for financial fraud and identity theft. For affected customers of Evertec's clients, this means increased vigilance against phishing attempts and unauthorized transactions. Law firms are investigating potential class action lawsuits, which adds legal and reputational risk for Evertec and its banking partners, as reported by BleepingComputer. This is about eroding trust, not just data loss.

Affected Scope & Remediation

The compromise impacts customers of Evertec's financial institution clients operating within Puerto Rico. Evertec has not confirmed the exact number of affected users or organizations, but Popular's public notifications signal a significant potential reach. The exposed data potentially includes critical personal and financial information, making affected individuals highly vulnerable to follow-on attacks, although Evertec has not confirmed the specific data types.

Given the nature of a third-party compromise, immediate remediation involves isolating the compromised vendor platform and auditing all connections and access permissions granted to it. Organizations using Evertec's services should review their vendor risk management frameworks and re-evaluate the access granted to all third-party support platforms. For endpoint detection and response, tools like CrowdStrike Falcon can help identify suspicious activity stemming from legitimate-looking vendor accounts. You must monitor not just your perimeter, but also your supply chain's perimeter. Organizations need to assume breach and harden their internal systems against potential lateral movement from compromised vendor accounts. Implement multi-factor authentication (MFA) everywhere, especially for vendor portals. It stops a lot of low-hanging fruit.

If your organization is an Evertec client, scrutinize all transactions and customer inquiries for anomalies originating post-May 13, 2026. Communicate proactively with your customers, advising them on potential phishing scams and encouraging them to monitor their financial statements. The CISA KEV catalog currently shows no new CVEs related to this incident in the last seven days, which means the initial vector was likely a zero-day, a previously unpublicized flaw in the third-party platform, or perhaps misconfigured access.

Technical Breakdown

A third-party support platform compromise often means an attacker gained access to a vendor's environment and then pivoted into client systems through pre-existing trust relationships or shared credentials. Think of it this way: your house has a strong security system, but you give a trusted delivery person a key to drop off packages. If that delivery person's key is stolen, your house is compromised, not because your locks failed, but because your trust in the third party was exploited. In this case, the "key" could be API credentials, VPN access, or even legitimate user accounts on the support platform itself.

Attackers exploiting this vector often use existing valid accounts to gain initial access, aligning with MITRE ATT&CK T1078 (Valid Accounts). Once inside the third-party system, they may attempt to compromise the software supply chain through that vendor, a technique categorized as T1195.002 (Compromise Software Supply Chain). This could involve injecting malicious code into updates, using administrative privileges to access client data directly, or using the trusted platform to initiate further attacks like spearphishing against Evertec's clients. Effective security here requires not just endpoint protection but stringent NIST SP 800-53 SA-10 (Developer Configuration Management) controls, ensuring vendors manage their configurations securely, and continuous monitoring through NIST SP 800-53 CA-7 (Continuous Monitoring) of third-party access and activity logs. Without this, you're flying blind on your vendor's network.

Historical Context

The Evertec incident echoes the Oncology Institute Data Breach in 2026, which similarly involved a third-party vendor compromise. In that case, the breach was attributed to an exploitation of systems administered by Kroll, a provider of incident response and security services, as reported by KrebsOnSecurity. Both incidents highlight a consistent trend: attackers are shifting focus to supply chain vulnerabilities.

The similarity lies in the exploitation of a trusted third party as an entry point into a primary organization's sensitive data. The difference might be in the type of third party: Kroll, in the Oncology Institute breach, provided security and legal services, while Evertec's breach involved a support platform. However, the fundamental attack surface — a vendor with privileged access — remains the same. This trend means rethinking traditional perimeter defenses to include effective vendor risk management.

Data at a Glance

Our Take

We're beyond the point where securing your own network is enough. This Evertec breach, like the Oncology Institute incident before it, should serve as a wake-up call for every CISO. Your third-party vendors are an extension of your attack surface, and they're becoming the preferred target for threat actors looking for the path of least resistance. You can't just trust them; you have to verify and continuously monitor their security posture and the access they have to your critical systems. The DBIR numbers confirm this.

The CVEDaily Take

Another third-party compromise, another financial institution affected. This pattern isn't breaking; it's accelerating. Supply chain risk management needs to be less about paperwork and more about continuous technical validation. We question how many organizations truly audit the actual permissions their third-party support vendors have in their production environment beyond initial onboarding.

FAQ

Q: What specific customer data was exposed in the Evertec data breach?
A: The breach potentially exposed sensitive customer information, including transaction records, payment card numbers, names, and contact information, though Evertec has not confirmed the full extent.

Q: Has Evertec identified the specific threat actor or vulnerability (CVE) responsible?
A: No, Evertec has not publicly disclosed a specific CVE ID, malware name, or threat actor name in relation to this incident as of its SEC filing.

Q: What should financial institutions using Evertec's services do now?
A: Financial institutions should immediately review and audit all access granted to Evertec's support platforms, enforce multi-factor authentication, and enhance monitoring for suspicious activity on accounts that interact with Evertec's services, especially those established before May 13, 2026.