The Company further believes that the incident was contained to the CareCloud Health environment and did not affect the Company’s other platforms, divisions, systems, data or environments. The incident was contained on the day it was discovered. The Company believes that it has sufficient cybersecurity insurance coverage for any potential losses. The Company further believes that the incident was caused by an unauthorized third party who temporarily had access to the system. The Company has reported the matter to the appropriate law enforcement authorities.

The Company is continuing to investigate the nature and scope of the incident. The affected environment stores patient information, and the Company continues to assess whether, and the extent to which, patient information or other data was accessed or exfiltrated, and the categories and volume of any such data.

All affected systems have been fully restored, and the Company believes that the threat actor no longer has any access to the same. As part of its remediation efforts, the Company is working with its outside cybersecurity experts to further reinforce its information technology systems and to prevent future unauthorized access.

As of the date of this Current Report on Form 8-K, the incident has not had a material impact on the Company’s operations. On March 24, 2026, the Company nevertheless determined that the incident is material in light of the sensitivity of the potentially affected information and the potential consequences of the incident, including remediation and response costs, legal, regulatory and notification-related matters, and possible effects on patients, customers, counterparties, reputation and operations. The Company believes that the incident is not reasonably likely to have a material impact on the Company’s financial condition or results of operations but has not yet determined the full impact of the incident. To the extent any information required by Item 1.05(a) of Form 8-K was not determined or was unavailable at the time of this filing, the Company will amend this Current Report on Form 8-K as such information is determined or becomes available.

Cautionary Statement Regarding Forward-Looking Statements

This Current Report on Form 8-K contains forward-looking statements within the meaning of the federal securities laws, including statements regarding the scope of the incident, whether and to what extent patient information or other data was accessed or exfiltrated, the categories and volume of data affected, the effectiveness of the Company’s containment and remediation efforts, the Company’s assessment of notification obligations, and the actual and reasonably likely impact of the incident on the Company’s business, operations, financial condition and results of operations. These statements are based on current information, estimates and assumptions and are subject to risks and uncertainties. Actual results may differ materially from those expressed or implied by these forward-looking statements. Except as required by law, the Company undertakes no obligation to update these statements.