CareCloud, Inc.

In addition to the other information set forth in this Quarterly Report on Form 10-Q, you should carefully consider the factors discussed in Part I—Item 1A. “Risk Factors” in our Annual Report on Form 10-K filed with the SEC on March 12, 2026, which could materially affect our business, financial condition and/or future results. The risks described in our Annual Report on Form 10-K are not the only risks facing us. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial may also materially adversely affect our business, financial condition, cash flows and/or future results.

The recent cybersecurity incident in our CareCloud Health division could result in material costs, regulatory action and reputational harm.

We experienced a cybersecurity incident involving unauthorized third party access to one cloud account supporting one of our CareCloud Health division electronic health record environments. The forensic investigation determined that an unauthorized third party claimed to have exfiltrated personally identifiable information and protected health information. While we have taken steps to contain and remediate the incident, including engaging third-party cybersecurity experts, notifying the affected healthcare customers, potentially affected individuals, and regulatory agencies, there can be no assurance that additional vulnerabilities will not be identified or that further unauthorized activity will not occur. The incident has resulted in, and may continue to result in, costs related to investigation, remediation, customer and patient notification, and legal proceedings. Additionally, this incident may harm our reputation, result in customer attrition, and expose us to regulatory penalties. We have provided notifications to applicable federal and state regulatory agencies as required. Regulatory agencies, including the U.S. Department of Health and Human Services Office for Civil Rights and state attorneys general, may open inquiries or investigations into the incident, which could result in fines, penalties, corrective action plans or other remedies, and responding to any such inquiries could involve costs and management attention. We may also face contractual claims from healthcare-provider customers, including indemnification claims or claims under business associate agreements. The incident may result in increased insurance premiums or retentions, or reduced availability of cybersecurity insurance on acceptable terms, and we expect to continue to incur costs to further enhance our information security safeguards. If our remediation efforts are not successful or timely, or if additional vulnerabilities are exploited, our business, financial condition, and results of operations could be materially adversely affected.

The use of artificial intelligence by threat actors, and our own development and deployment of AI-enabled products, may increase the risk and potential severity of future cybersecurity incidents.

Advances in AI have lowered the barriers to, and increased the sophistication of, cyberattacks, including AI-generated phishing and social-engineering campaigns, deepfake-enabled impersonation, and automated discovery and exploitation of vulnerabilities, and we expect the frequency and sophistication of such attacks to increase. In addition, our own AI solutions, including CareCloud cirrusAI and CareCloud stratusAI, process personally identifiable information and protected health information and rely on third-party models and cloud infrastructure, which may create new attack surfaces and data-handling risks. Although we have implemented and continue to enhance safeguards, we cannot guarantee these measures will prevent future incidents, and any future incident could result in costs, regulatory action, litigation, customer attrition and reputational harm materially greater than those associated with the March 2026 incident.

Geopolitical or economic developments affecting our offshore operations could increase our costs and impair our ability to service client accounts.

As described in our Annual Report on Form 10-K, our business model depends on our offshore operations in Pakistan, Azad Jammu and Kashmir and Sri Lanka, where approximately 3,100 of our team members are located and where personnel costs are significantly lower than in the United States. Regional conflicts or the escalation of tensions in or affecting the regions where we operate, trade restrictions, sanctions, changes in diplomatic relations or political stability, currency devaluation or restrictions on the repatriation of funds, infrastructure disruptions, visa or travel restrictions, and local wage inflation could increase our operating costs or impair our ability to deliver services to our clients at current service levels and prices. Because our offshore operations are concentrated in a small number of locations, a disruption affecting any one of them could have a disproportionate impact on our ability to deliver services. If we were required to shift a material portion of this work to the United States or other higher-cost locations, our expenses would increase materially, our margins would decline, and we may be unable to serve client accounts at current service levels or competitive prices.

The financial markets have from time to time encountered volatility associated with concerns about the balance sheets of banks, especially small and regional banks who may have significant losses associated with investments that make it difficult to fund demands to withdraw deposits and other liquidity needs. Although the federal government has announced measures to assist these banks and protect depositors, some banks have already been impacted and others may be materially and adversely impacted. Our business is dependent on bank relationships and we are proactively monitoring the financial health of such bank relationships. Continued strain on the banking system may adversely impact our business, financial condition and results of operations.