• Between April 22 and April 24, 2020, Popular uploaded certain PPP loan application information to the SBA’s test application platform in an effort to ensure the appropriate processing of PPP loan applications.
• Based on our investigation, the information that may have been briefly visible to limited lenders and their vendors authorized by the SBA to use the test application platform included business contact and business information about the company of which you are a principal owner, such as business address and tax identification number (TIN). As a principal owner, personal information about you, such as your name, address, Social Security Number and email address may have been uploaded to the test application platform.
• There is no indication that any of the participating authorized PPP lenders or their vendors accessed, compromised or misused your information, and the fact that your information was potentially exposed on SBA’s test application platform does not mean that it has or will be used to commit fraud.
• On April 24, 2020, the SBA shut down the test application platform and the applicant information uploaded by all participating lenders and their vendors was purged.

Popular takes customer privacy very seriously and adheres to high information security standards to ensure that the information of our customers is afforded the highest level of confidentiality. We have conducted our own internal investigation to protect and minimize any financial impact to you. As an added precaution and a courtesy to you, we have arranged with Equifax, Inc. (“Equifax”) to provide you with complimentary credit monitoring services for one (1) year. Equifax is one of the primary credit-reporting agencies in the United States, and Popular will assume the cost of these services if you decide to subscribe.

If you subscribe to these Equifax’s services, you will obtain:

• Comprehensive credit file monitoring and automated alerts for key changes to your Equifax, Experian, and TransUnion credit reports;
• Free credit reports for one (1) year;
• A 3-in-1 Credit Report and access to your Equifax Credit Report™; and
• Up to one million dollars ($1,000,000.00) in identity theft insurance with zero ($0) deductible, at no additional cost to you.

You can subscribe to these Equifax’s services online by visiting www.myservices.equifax.com/tri and following the instructions enclosed. Please, use the personalized activation code provided to you via email to subscribe and benefit from this service on or before January 31, 2021.

Regardless of whether you decide to take advantage of Equifax’s service, the applicable federal laws grant you the right to obtain a free annual copy or your credit report from each credit reporting agency using the contact information provided below. We recommend that you periodically obtain credit reports from each credit-reporting agency and have information relating to any fraudulent transactions deleted.

In addition to subscribing to Equifax’s credit monitoring services, you may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least 90 days. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three (3) credit reporting agencies identified above. Additional information is available at http://www.annualcreditreport.com.

You may also have the right to put a credit freeze, also known as a security freeze, on your credit file, so that no new credit can be opened in your name without the use of a personal identification number (“PIN”) or password that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential credit grantors from accessing your credit report without consent. If you place a security freeze, potential creditors and other third parties will not be able to access your credit report unless you temporarily lift the freeze. Therefore, using a security freeze may delay your ability to obtain credit. There is no fee to place or lift a security freeze. Unlike a fraud alert, you must separately place a security freeze on your credit file at each credit reporting company. For information and instructions to place a security freeze, contact each of the credit reporting agencies. To request a freeze, you may need to provide the following information:

• Your full name (including middle initial as well as Jr., Sr., II, III, etc.)
• Social Security number
• Date of birth
• If you have moved in the past five years, provide the addresses where you have lived over the prior five years
• Proof of current address, such as a current utility bill or telephone bill
• A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.)

The credit reporting agencies have one business day after receiving your request by toll-free telephone or secure electronic means, or three business days after receiving your request by mail, to place a security freeze on your credit report. The credit bureaus must also send written confirmation to you within five business days, and provide you with a unique PIN or password or both that you can use to authorize the removal or lifting of the security freeze.

To remove the security freeze or to temporarily lift the security freeze for a specified period or to allow a specific entity or individual access to your credit report, you must submit a request through a toll-free telephone number, a secure electronic means maintained by a credit reporting agency, or by sending a written request via regular, certified, or overnight mail to the credit reporting agency and include proper identification (name, address, and Social Security number) and the PIN or password provided to you when you placed the security freeze. If you are seeking to temporarily lift, rather than remove the freeze, you must also include the specific period of time during which you want the credit report available or the identity of those entities or individuals you would like to receive access to your credit report. The credit reporting agencies have one business day after receiving your request by toll-free telephone or secure electronic means, or three business days after receiving your request by mail, to remove the security freeze or lift the freeze for the specified period or identified entities or individuals.

Protecting your information and providing you with the information and assistance you may need is very important to us. If you have any questions about this incident, please feel free to contact us at +1 787.756.3939+1 787.756.3939, Monday through Friday, from 8:00 a.m. to 5:00 p.m.

As a precautionary measure, we recommend that you remain vigilant by reviewing your account statements and credit reports closely over the next 12 to 24 months. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You also should promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, including your state attorney general and the Federal Trade Commission (FTC). To file a complaint with the FTC, go to https://www.IdentityTheft.gov or call 1-877-ID-THEFT (877.438.4338877.438.4338). Complaints filed with the FTC will be added to the FTC’s Identity Theft Data Clearinghouse, which is a database made available to law enforcement agencies.