CareCloud, Inc.

Previous wording

We experienced a cybersecurity incident involving unauthorized third party access to one cloud account supporting one of our CareCloud Health division electronic health record environments. The forensic investigation determined that an unauthorized third party claimed to have exfiltrated personally identifiable information and protected health information. While we have taken steps to contain and remediate the incident, including engaging third-party cybersecurity experts, notifying the affected healthcare customers, potentially affected individuals, and regulatory agencies, there can be no assurance that additional vulnerabilities will not be identified or that further unauthorized activity will not occur. The incident has resulted in, and may continue to result in, costs related to investigation, remediation, customer and patient notification, and legal proceedings. Additionally, this incident may harm our reputation, result in customer attrition, and expose us to regulatory penalties. We have provided notifications to applicable federal and state regulatory agencies as required. Regulatory agencies, including the U.S. Department of Health and Human Services Office for Civil Rights and state attorneys general, may open inquiries or investigations into the incident, which could result in fines, penalties, corrective action plans or other remedies, and responding to any such inquiries could involve costs and management attention. We may also face contractual claims from healthcare-provider customers, including indemnification claims or claims under business associate agreements. The incident may result in increased insurance premiums or retentions, or reduced availability of cybersecurity insurance on acceptable terms, and we expect to continue to incur costs to further enhance our information security safeguards. If our remediation efforts are not successful or timely, or if additional vulnerabilities are exploited, our business, financial condition, and results of operations could be materially adversely affected.

Current wording

We experienced a cybersecurity incident involving unauthorized third-party access to one cloud account supporting one of our CareCloud Health division electronic health record environments. The forensic investigation determined that the unauthorized third-party exfiltrated certain patient-related information from the affected environment associated with a substantial number of individuals, including personally identifiable information and protected health information. While we have taken steps to contain and remediate the incident, including engaging third-party cybersecurity experts and notifying the affected healthcare customers, potentially affected individuals, and regulatory agencies, there can be no assurance that additional vulnerabilities will not be identified or that further unauthorized activity will not occur. The incident has resulted in, and may continue to result in, costs related to investigation, remediation, customer and patient notification, and legal proceedings. Additionally, this incident may harm our reputation, result in customer attrition, and expose us to regulatory penalties. We have provided notifications to applicable federal and state regulatory agencies as required. Regulatory agencies, including the U.S. Department of Health and Human Services Office for Civil Rights and state attorneys general, may open inquiries or investigations into the incident, which could result in fines, penalties, corrective action plans or other remedies, and responding to any such inquiries could involve costs and management attention. We may also face contractual claims from healthcare-provider customers, including indemnification claims or claims under business associate agreements. The incident may result in increased insurance premiums or retentions, or reduced availability of cybersecurity insurance on acceptable terms, and we expect to continue to incur costs to further enhance our information security safeguards. If our remediation efforts are not successful or timely, or if additional vulnerabilities are exploited, our business, financial condition, and results of operations could be materially adversely affected.

Previous wording

As described in our Annual Report on Form 10-K, our business model depends on our offshore operations in Pakistan, Azad Jammu and Kashmir and Sri Lanka, where approximately 3,100 of our team members are located and where personnel costs are significantly lower than in the United States. Regional conflicts or the escalation of tensions in or affecting the regions where we operate, trade restrictions, sanctions, changes in diplomatic relations or political stability, currency devaluation or restrictions on the repatriation of funds, infrastructure disruptions, visa or travel restrictions, and local wage inflation could increase our operating costs or impair our ability to deliver services to our clients at current service levels and prices. Because our offshore operations are concentrated in a small number of locations, a disruption affecting any one of them could have a disproportionate impact on our ability to deliver services. If we were required to shift a material portion of this work to the United States or other higher-cost locations, our expenses would increase materially, our margins would decline, and we may be unable to serve client accounts at current service levels or competitive prices.

Current wording

As described in our Annual Report on Form 10-K, our business model depends on our offshore operations in Pakistan, Azad Jammu and Kashmir and Sri Lanka, where approximately 3,000 of our team members are located and where personnel costs are significantly lower than in the United States. Regional conflicts or the escalation of tensions in or affecting the regions where we operate, trade restrictions, sanctions, changes in diplomatic relations or political stability, currency devaluation or restrictions on the repatriation of funds, infrastructure disruptions, visa or travel restrictions, and local wage inflation could increase our operating costs or impair our ability to deliver services to our clients at current service levels and prices. Because our offshore operations are concentrated in a small number of locations, a disruption affecting any one of them could have a disproportionate impact on our ability to deliver services. If we were required to shift a material portion of this work to the United States or other higher-cost locations, our expenses would increase materially, our margins would decline, and we may be unable to serve client accounts at current service levels or competitive prices.