CareCloud, Inc.

Item 1A. Risk Factors

In addition to the other information set forth in this Quarterly Report on Form 10-Q, you should carefully consider the factors discussed in Part IItem 1A. Risk Factors in our Annual Report on Form 10-K filed with the SEC on March 12, 2026, which could materially affect our business, financial condition and/or future results. The risks described in our Annual Report on Form 10-K are not the only risks facing us. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial may also materially adversely affect our business, financial condition, cash flows and/or future results.

The recent cybersecurity incident in our CareCloud Health division could result in material costs, regulatory action and reputational harm.

We recently eexperienced a cybersecurity incident involving unauthorized athird party access to certain oone cloud account supporting one of our informCareCloud Health division electronic health record environments. The forensic investigation systemsdetermined that an unauthorized third party claimed to have exfiltrated personally identifiable information and protected health information. While we have taken steps to contain and remediate the incident, including engaging third-party cybersecurity experts, thenotifying the affected healthcare can ustomers, potentially affected individuals, and regulatory agencies, there can be no assurance that additional vulnerabilities will not be identified or that further unauthorized activity will not occur. The incident has resulted in, and may continue to result in, costs related to investigation, remediation, legal proceedings, regulatory inquiries, customer and customerpatient notification, and legal proceedings. Additionally, this incident may harm our reputation, result in customer attrition, and expose us to litigregulatory penalties. We have provided notification or s to applicable federal and state regulatory penaltagencies as required. Regulatory agencies. Because the in, including the U.S. Department of Health and Human Services Office for Civil Rights and state attorneys general, may open inquiries or investigation is ongoings into the incident, we have not yet determined the full scope of data that may have been accessed, including the number of patients potentiallhich could result in fines, penalties, corrective action plans or other remedies, and responding to any such inquiries could involve costs and management attention. We may also face contractual claims from healthcare-provider customers, including indemnification claims or claims under business associate agreements. The incident may result in increased insurance premiums or retentions, or reduced availability of cybersecurity insurance on acceptable terms, and we expect to continue to incur costs to further enhance our information security safeguards. If our remediation efforts are not successful or timely, or if additional vulnerabilities are exploited, our business, financial condition, and results of operations could be materially adversely affected and the categories of data.

The use of artificial intelligence by threat actors, and our own development and deployment of AI-enabled products, may increase the risk and potential severity of future cybersecurity incidents.

Advances involved AI have lowered the barriers to, and increased the ultisophistication of, cyberattacks, including AI-generated phishing and social-engineering campaigns, deepfake-enabled impersonation, and automate costsd discovery and exploitation of vulnerabilities, and we expect the frequency and sophistication of responsuch attacks to increase. In addition, our own AI solutions, including to, remediCareCloud cirrusAI and CareCloud stratusAI, process personally identifiable information and protected health informatingon and resolving the inly on third-party models and cloud infrastructure, which may create new attack surfaces and data-handling risks. Although we have implemented and continue to enhance safeguards, we cannot guarantee these measures will prevent future incident cs, and any future incident could exceed ouresult in costs, regulatory action, litigation, customer available cybersecurity insuranttrition and reputational harm materially greater than those associated with the March 2026 incident.

Geopolitical or economic developments affecting our offshore operations could increase our costs and impair our ability to service coverage. Iflient accounts.

As described in our remediAnnual Report on Form 10-K, our business model depends on our offshore operation efforts in Pakistan, Azad Jammu and Kashmir and Sri Lanka, where approximately 3,100 of our team members are not successful olocated and where personnel costs are significantly lower timely, or if addihan in the United States. Regional conflicts or the escalation of tensions in or affecting the regions where we operate, trade restrictional vulneras, sanctions, changes in diplomatic relations or political stabilities are exploited, our business, financial condiy, currency devaluation or restrictions on the repatriation of funds, infrastructure disruptions, visa or travel restrictions, and local wage inflation could increase our operating costs or impair our ability to deliver services to our clients at current service levels and prices. Because our offshore operations are concentrated in a small number of locations, a disruption, and results of opera affecting any one of them could have a disproportionate impact on our ability to deliver services. If we were required to shift a material portions cou of this work to the United States or other higher-cost locations, our expenses would beincrease materially adversely affected, our margins would decline, and we may be unable to serve client accounts at current service levels or competitive prices.

We maintain our cash at financial institutions, often in balances that exceed federally insured limits.

The financial markets recently havhave from time to time encountered volatility associated with concerns about the balance sheets of banks, especially small and regional banks who may have significant losses associated with investments that make it difficult to fund demands to withdraw deposits and other liquidity needs. Although the federal government has announced measures to assist these banks and protect depositors, some banks have already been impacted and others may be materially and adversely impacted. Our business is dependent on bank relationships and we are proactively monitoring the financial health of such bank relationships. Continued strain on the banking system may adversely impact our business, financial condition and results of operations.