CORVEL CORP

Previous wording

A cybersecurity attack or other disruption to our information technology systems could result in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or sensitive company information or could disrupt our operations, which could damage our relationships with customers or employees, expose us to litigation or regulatory proceedings, or harm our reputation, any of which could materially adversely affect our business, financial condition or results of operations.

Current wording

A cybersecurity attack or other disruption to our information technology systems could result in the loss, theft, misuse, unauthorized disclosure, unauthorized access of sensitive customer or Company information, or disruption of our operations, which could damage our relationships with customers or employees, expose us to litigation or regulatory proceedings, or harm our reputation, any of which could materially adversely affect our business, financial condition or results of operations.

Previous wording

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our company’s financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks, which may prevent us from maintaining the privacy of this information, result in the disruption of our business and online systems, and require us to expend significant resources attempting to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Current wording

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our Company’s financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks. These risks may prevent us from maintaining the confidentiality of this information, result in the disruption of our business and online systems, and require us to expend significant resources to attempt to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Previous wording

Security incidents of any of the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents generally has significantly increased around the globe in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in incidents, caused by computer viruses, unauthorized parties gaining access to our information technology systems and similar threats. Cybersecurity incidents could cause in some cases, reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and enhancing further system protective measures could increase significantly as cybersecurity threats increase, and there can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

Current wording

Cybersecurity incidents of any of the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents has significantly increased worldwide in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in cybersecurity incidents caused by computer viruses, unauthorized parties gaining access to our information technology systems, and other similar threats. In some cases, cybersecurity incidents could cause reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses, or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and further enhancing our system’s protective measures could increase significantly as cybersecurity threats increase. There can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

Previous wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cyber-attacks or data handling incidents could remain undetected for some period, which could potentially result in significant harm to our systems, as well as unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause incidents that could harm our systems or result in the unauthorized disclosure of or access to information. Any measures we do take to prevent security incidents, whether caused by employees or third parties, could have the potential to impact our relationships with our customers or restrict our ability to meet our customers' expectations.

Current wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cybersecurity-attacks or data handling incidents could remain undetected for some period of time, which could not only result in significant harm to our systems, but also lead to unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause cybersecurity incidents. Any occurence of cybersecurity incidents, whether caused by employees or third parties, could have the potential to impact our relationships with our customers or restrict our ability to meet our customers’ expectations.

Previous wording

Additionally, as artificial intelligence technologies continue to develop and become more accessible, malicious actors are increasingly leveraging artificial intelligence to carry out advanced cyber-attacks. These artificial intelligence tools can be used to automate and scale attacks, generate phishing or social engineering schemes, employ deepfakes, identity system vulnerabilities, or evade transitional detection methods. Consequently, the use of artificial intelligence by malicious actors may result in an increase in the frequency, speed, and severity of cyber threats targeting our systems, networks, and employees.

Current wording

Additionally, as artificial intelligence technologies continue to develop and become more accessible, malicious actors are increasingly leveraging it to carry out advanced cyber-attacks. These artificial intelligence tools can be used to automate and scale attacks, generate phishing or social engineering schemes, employ deepfakes, identity system vulnerabilities, or evade transitional detection methods. Consequently, the use of artificial intelligence by malicious actors may result in an increase in the frequency, speed, and severity of cyber threats targeting our systems, networks, and employees.

Previous wording

If a cyber-attack or other data incident results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of personal, confidential, or sensitive information belonging to our customers or employees, it could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our services, cause our customers to reconsider their relationship with our company or impose more onerous contractual provisions, cause us to lose our regulatory licenses, and subject us to potential litigation, liability, fines and penalties. For example, we could be subject to regulatory or other actions pursuant to privacy laws. This could result in costly investigations and litigation, civil or criminal penalties, operational changes and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

Current wording

If a cyber-attack or other data incident results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of personal, confidential, or sensitive information belonging to our customers or employees, it could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our services, cause our customers to reconsider their relationship with us, impose more onerous contractual provisions, cause us to lose our regulatory licenses, or subject us to potential litigation, liability, fines and penalties. For example, we could become subject to regulatory or other actions pursuant to privacy laws. This could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

Previous wording

A cyber-attack resulting in a security incident could have a significant impact on the business up to a protracted disruption of our business:

Current wording

A cyber-attack resulting in a cybersecurity incident could have a significant impact on our business for a prolonged period of time, including:

Previous wording

critical business systems become inoperable or require a significant amount of time or cost to restore;

Current wording

critical business systems becoming inoperable or requiring a significant amount of time or cost to restore;

Previous wording

key personnel are unable to perform their duties or communicate with employees, customers or other third-parties;

Current wording

key personnel being unable to perform their duties or communicate with employees, customers or other third-parties;

Previous wording

it results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or company information;

Current wording

the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or Company information;

Previous wording

customers cannot access our websites and online systems; or

Current wording

our customers losing the ability to access our websites and online systems; or

Previous wording

In 1996, the Board of Directors authorized a stock repurchase program (the “stock repurchase program”) and, since then, has periodically increased the number of shares authorized for repurchase under the program. In 2022, the Board of Directors authorized the repurchase of additional shares under the stock repurchase program, thereby increasing the total number of shares of common stock approved for repurchased under the program to 117,000,000. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

Current wording

In 1996, the Board of Directors (the “Board”) authorized a stock repurchase program (the “stock repurchase program”) and, since then, has periodically increased the number of shares authorized for repurchase under the program. In 2022, the Board authorized the repurchase of additional shares under the stock repurchase program, thereby increasing the total number of shares of common stock approved for repurchase under the program to 117,000,000. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

Previous wording

The following table sets forth the repurchases of our common stock made by or on behalf of the Company during the quarter ended June 30, 2025, all of which were made in open-market purchases pursuant to our publicly announced stock repurchase plan.

Current wording

The following table sets forth the repurchases of our common stock made by or on behalf of the Company during the three months ended September 30, 2025, all of which were made in open-market purchases pursuant to our publicly announced stock repurchase plan.

Previous wording

In 1996, the Board of Directors authorized a stock repurchase program for up to 100,000 original shares of our common stock. The Board has periodically increased the number of shares authorized for repurchase under the repurchase program. In November 2022, the Board increased the number of shares of common stock authorized to be repurchased over the life of the program by 3,000,000 shares to 117,000,000 shares. There is no expiration date for the program. The program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion.

Current wording

In 1996, the Board authorized a stock repurchase program for up to 100,000 original shares (not adjusted for historical stock splits) of our common stock. The Board has periodically increased the number of shares authorized for repurchase under the repurchase program. In 2022, the Board authorized the repurchase of additional shares under the stock repurchase program, thereby increasing the total number of shares of common stock approved for repurchased under the program to 117,000,000. There is no expiration date for the program. The program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion.

Previous wording

During the three months ended June 30, 2025, the Company repurchased 87,105 shares of its common stock for $9.6 million under the program, reflecting an average price of $110.01 per share. As of June 30, 2025, the Company repurchased 114,563,796 shares of its common stock over the life of the program.

Current wording

During the three months ended September 30, 2025, the Company repurchased 143,774 shares of its common stock for $12.8 million under the program, reflecting an average price of $89.06 per share. As of September 30, 2025, the Company repurchased 114,707,570 shares of its common stock over the life of the program.