We are, from time to time, party to various claims and legal proceedings arising in the ordinary course of our business. Data Breach Litigation: Beginning on June 12, 2026, a series of putative class action lawsuits were filed in the United States District Court for the District of Puerto Rico, and in the Superior Court of the Commonwealth of Puerto Rico, against the Company relating to a cybersecurity incident (the “Incident”) involving a third-party support platform that exposed certain customer data and transaction records primarily affecting financial institutions in Puerto Rico. Plaintiffs are individual consumers who allege that their personal information was impacted in the Incident, which they allege may have included their names, contact information, transaction records, and payment card numbers. Plaintiffs generally allege that the Incident occurred due to the Company’s failure to implement adequate and reasonable cybersecurity procedures and protocols, and bring claims for negligence, breach of contract, unjust enrichment on behalf of a proposed class of all individuals impacted by the Incident. Plaintiffs have moved to consolidate the four cases pending in federal court and intend to file a consolidated complaint. The Company intends to file a motion to dismiss the consolidated complaint and intends to separately move to dismiss the pending Superior Court case. The Company believes that the lawsuits relating to the Incident are without merit and intends to vigorously defend them. See Part I, Item 1 “Financial Statements (Unaudited) - Note 15, Commitments and Contingencies,” incorporated herein by reference, for a discussion of material legal proceedings.