EVERTEC, Inc.

Item 1. Legal Proceedings

We are, from time to time, party to various claims and legal proceedings arising in the ordinary course of our business.

Data Breach Litigation:

Beginning on June 12, 2026, a series of putative class action lawsuits were filed in the United States District Court for the District of Puerto Rico, and in the Superior Court of the Commonwealth of Puerto Rico, against the Company relating to a cybersecurity incident (the “Incident”) involving a third-party support platform that exposed certain customer data and transaction records primarily affecting financial institutions in Puerto Rico. Plaintiffs are individual consumers who allege that their personal information was impacted in the Incident, which they allege may have included their names, contact information, transaction records, and payment card numbers. Plaintiffs generally allege that the Incident occurred due to the Company’s failure to implement adequate and reasonable cybersecurity procedures and protocols, and bring claims for negligence, breach of contract, unjust enrichment on behalf of a proposed class of all individuals impacted by the Incident.

The four cases pending in federal court relating to the Incident have been consolidated, and on October 5, 2026, plaintiffs filed a consolidated complaint. The Company intends to file a motion to dismiss the consolidated complaint, and has separately moved to stay the pending Superior Court case until the federal consolidated action is resolved. The Company believes that the lawsuits relating to the Incident are without merit, and intends to vigorously defend them.

See Part I, Item 1 “Financial Statements (Unaudited) - Note 15, Commitments and Contingencies,” incorporated herein by reference, for a discussion of material legal proceedings.