Legal Proceedings — A former customer had a dispute with the Company that was based on services before and after the account was acquired in an acquisition. A complaint was filed in Massachusetts State Court, Essex County in February 2018. Under the terms of the purchase agreement, the Company’s liability, if any, was solely and expressly limited to damages related to its handling of the account at issue. The parties participated in formal mediation and at that time, Plaintiff’s starting settlement demand was over $2 million. The mediation was not successful. The Company made an offer of $100,000 in December 2024 to settle the suit, which was accepted. The settlement amount was recorded in accrued expenses at December 31, 2024 in the condensed consolidated balance sheet. A settlement agreement with mutual releases was signed by the parties in January 2025 and payment was made in February 2025.

A dispute occurred with a former customer regarding previous services rendered and they filed a complaint in New York Supreme Court, Onondaga County in January 2024. During settlement communications, Plaintiff’s initial settlement demand was over $2.5 million. During ongoing settlement communications, the Company made an offer of $29,000 in March 2025, which was accepted. A settlement agreement with mutual releases was signed by the parties in May 2025 and payment was made in June 2025.

Cybersecurity Incident — On March 16, 2026, the Company detected a security incident in its CareCloud Health division that affected functionality and data access in one of its six electronic health record environments for approximately eight hours, after which all functionality and data access were fully restored. Upon discovery, the Company notified its cybersecurity carrier and engaged a leading cyber response advisory team within a Big Four accounting firm to secure the environment and conduct a comprehensive forensic investigation.

The forensic investigation determined that an unauthorized third party gained access to one cloud account supporting the previously identified electronic health record environment and exfiltrated patient-related information from the affected environment associated with a substantial number of individuals, including personally identifiable information and protected health information. The investigation found no evidence of unauthorized activity related to the incident after March 16, 2026 and all affected systems remain fully operational. The Company has notified affected healthcare-provider customers, and the Company is providing required notifications to potentially affected individuals and applicable regulatory agencies pursuant to the agreements with those customers.

To date, multiple class action complaints were filed against the Company alleging personal information was compromised in connection with the security incident. In June 2026, the United States District Court for the Southern District of Florida consolidated the actions, and the plaintiffs filed a consolidated amended complaint shortly thereafter. The Company intends to defend the matter vigorously and believes that its available cybersecurity insurance coverage is likely to be sufficient for the losses it currently anticipates in connection with the matter, subject to applicable policy terms, limits, retentions, exclusions and coverage determinations. We believe costs incurred in connection with the incident, including the forensic investigation, remediation, notification, litigation, and legal costs, will be reimbursed by the Company’s cybersecurity insurance carrier, other than the Company’s $100,000 retention.

From time to time, the Company may become involved in other legal proceedings arising in the ordinary course of business. The Company is not presently a party to any legal proceedings that, in the opinion of management, would individually or in the aggregate have a material adverse effect on our business, consolidated results of operations, financial position, or cash flows.