T Mobile US (TMUS) Risk Factors

We and our affiliates are involved in various disputes, governmental and/or regulatory inspections, investigations and proceedings, mass arbitrations and litigation matters. Such legal proceedings can be complex, costly, and highly disruptive to our business operations by diverting the attention and energy of management and other key personnel. In connection with the Transactions, we became subject to a number of legal proceedings, including a putative shareholder class action and derivative lawsuit and a putative antitrust class action. For more information, see "– Contingencies and Litigation – Litigation and Regulatory Matters" in Note 17 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. It is possible that stockholders of T-Mobile and/or Sprint may file additional putative class action lawsuits or shareholder derivative actions against the Company and the legacy T-Mobile board of directors and/or the legacy Sprint board of directors. Among other remedies, these stockholders could seek damages. The outcome of any litigation is uncertain, and any such potential lawsuits could result in substantial costs and may be costly and distracting to management. Additionally, on April 1, 2020, in connection with the closing of the Merger, we assumed the contingencies and litigation matters of Sprint. Those matters include a wide variety of disputes, claims, government agency investigations and enforcement actions and other proceedings. Unfavorable resolution of these matters could require us to make additional reimbursements and pay additional fines and penalties. On February 28, 2020, we received a Notice of Apparent Liability for Forfeiture and Admonishment from the FCC, which proposed a penalty against us for allegedly violating Section 222 of the Communications Act and the FCC's regulations governing the privacy of customer information. We recorded an accrual for an estimated payment amount as of March 31, 2020, which is included in Accounts payable and accrued liabilities on our Consolidated Balance Sheets. As a result of the August 2021 cyberattack, we are subject to numerous lawsuits, including consolidated class action lawsuits seeking unspecified monetary damages, mass consumer arbitrations, a shareholder derivative lawsuit and inquiries by various government agencies, law enforcement and other governmental authorities, and we may be subject to further regulatory inquiries and private litigation. We are cooperating fully with regulators and vigorously defending against the class actions and other lawsuits. On July 22, 2022, we entered into an agreement to settle the consolidated class action lawsuit. On June 29, 2023, the Court issued an order granting final approval of the settlement, which is subject to potential appeals. Under the terms of the settlement, we would pay an aggregate of $350 million to fund claims submitted by class members, the legal fees of plaintiffs' counsel and the costs of administering the settlement. We would also commit to an aggregate incremental spend of $150 million for data security and related technology in 2022 and 2023. We previously paid $35 million for claims administration purposes. On July 31, 2023, a class member filed an appeal to the final approval order challenging the Court's award of attorneys' fees to class counsel. We expect the remaining portion of the $350 million settlement payment to fund claims to be made once that appeal is resolved. In connection with the class action settlement and other settlements of separate consumer claims that have been previously completed or are currently pending, we recorded a total pre-tax charge of approximately $400 million during the three months ended June 30, 2022. In light of the inherent uncertainties involved in such matters and based on the information currently available to us, we believe it is reasonably possible that we could incur additional losses associated with these proceedings and inquiries, and we will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. In addition, in connection with the January 2023 cyberattack, we have received notices of consumer class actions and regulatory inquires, to which we will continue to respond in due course. Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries related to the August 2021 cyberattack and the January 2023 cyberattack, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be significant and have a material adverse impact on our business, reputation, financial condition, cash flows and operating results. We, along with equipment manufacturers and other carriers, are subject to current and potential future lawsuits alleging adverse health effects arising from the use of wireless handsets or from wireless transmission equipment such as cell towers. In addition, the FCC has from time to time gathered data regarding wireless device emissions, and its assessment of the risks associated with using wireless devices may evolve based on its findings. Any of these allegations or changes in risk assessments could result in customers purchasing fewer devices and wireless services, could result in significant legal and regulatory liability, and could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. The assessment of the outcome of legal proceedings, including our potential liability, if any, is a highly subjective process that requires judgments about future events that are not within our control. The amounts ultimately received or paid upon settlement or pursuant to final judgment, order or decree may differ materially from amounts accrued in our financial statements. In addition, litigation or similar proceedings could impose restraints on our current or future manner of doing business. Such potential outcomes including judgments, awards, settlements or orders could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

In connection with the products and services we sell, we calculate, collect, and remit various federal, state, and local taxes, fees and regulatory charges ("tax" or "taxes") to numerous federal, state and local governmental authorities, including federal and state USF contributions and common carrier regulatory charges and public safety fees. As many of our service plans offer taxes and fees inclusive, our business results could be adversely impacted by increases in taxes and fees. In addition, we incur and pay state and local transaction taxes and fees on purchases of goods and services used in our business. Tax laws are dynamic and subject to change as new laws are passed and new interpretations of the laws are issued or applied. In many cases, the application of existing, newly enacted or amended tax laws may be uncertain and subject to different interpretations, especially when evaluated against new technologies and telecommunications services, such as broadband internet access and cloud-related services and in the context of our merger with Sprint. Legislative changes, administrative interpretations and judicial decisions affecting the scope or application of tax laws could also impact revenue reported and taxes due on tax inclusive plans. Additionally, failure to comply with any of the tax laws could subject us to additional taxes, fines, penalties, or other adverse actions. In the event that federal, state, and/or local municipalities were to significantly increase taxes and regulatory or public safety charges on our network, operations, or services, or seek to impose new taxes or charges, it could have a material adverse effect on our business, financial condition, and operating results.

We rely on a variety of intellectual property assets, including patents, copyrights, trademarks, and domains, to maintain our competitiveness. If we are unable to protect our intellectual property due to factors such as changes in US intellectual property laws, the value of our intellectual property may become impaired, which may adversely impact our business and financial results. Additionally, we have faced and will continue to face various litigations alleging that our products or services infringe patents or other intellectual property of third parties. If successful, these litigations could result in an award of financial compensation, including damages or royalties, business disruptions, reputational harm, or an order requiring that we cease offering, selling, and using the relevant products, equipment, services, and network functions. Defending against such litigation is not only costly and time-consuming, but it may also be disruptive to our business operations and divert resources and attention. Furthermore, the outcomes of these litigations are inherently uncertain. Our suppliers and vendors also have and will continue to face intellectual property litigation related to the technology used in the products, equipment, and services they provide to us. If successful, such litigation against our suppliers and vendors might impact their ability to continue to provide the relevant products, equipment, and services to us.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, "Confidential Information"). Additionally, to offer services to our customers and operate our business, we utilize a number of applications and systems, including those we own and operate as well as others provided by third-party providers, such as cloud services (collectively, "Systems"). We are subject to persistent cyberattacks and threats to our business from a variety of bad actors, many of whom attempt to gain unauthorized access to and compromise Confidential Information and Systems. In some cases, the bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information. In other cases, these bad actors may obtain unauthorized access to Confidential Information by exploiting insider access or utilizing log in credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means. Other bad actors aim to cause serious operational disruptions to our business and Systems through ransomware or distributed denial of services attacks. Cyberattacks against companies like ours have increased in frequency and scope of potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and detect incidents successfully in every instance. They are perpetrated by a variety of groups and persons, including state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments. In addition, we routinely rely upon third-party providers whose products and services are used in our business. These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information. In August 2021, we disclosed that our systems were subject to a criminal cyberattack that compromised certain data of millions of our current customers, former customers, and prospective customers, including, in some instances, social security numbers, names, addresses, dates of birth and driver's license/identification numbers. As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation. For more information, see "– Contingencies and Litigation – Litigation and Regulatory Matters" in Note 17 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. In January 2023, we disclosed that a bad actor was obtaining data through a single Application Programming Interface ("API") without authorization that was only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features. Our investigation indicated that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. In addition to the August 2021 cyberattack and the January 2023 cyberattack, we have experienced other unrelated non-material incidents involving unauthorized access to certain Confidential Information and Systems. Typically, these incidents have involved attempts to commit fraud by taking control of a customer's phone line, often by exploiting insider access or using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers' private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property. Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers. Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers, including through our cybersecurity programs or policies. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers' systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers' systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third-party providers, including through our cybersecurity programs or policies, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. We also expect that threat actors will continue to gain sophistication including in the use of tools and techniques (such as artificial intelligence) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more challenging for us to identify, investigate and recover from future cyberattacks in a timely and effective manner. In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Our future success depends in substantial part on our ability to recruit, hire, motivate, develop, and retain talented personnel for all areas of our organization, including our CEO and members of our senior leadership team. Both external factors, such as fluctuations in economic and industry conditions, changes in U.S. immigration policies, and the competitive landscape, and internal factors, such as employee tolerance for changes in our corporate culture, organizational changes, limited remote working opportunities, and our compensation programs, may impact our ability to effectively manage our workforce. Further, employee compensation and benefit costs may increase due to inflationary pressures, and if our compensation does not keep up with inflation or that of our competitors', we may see increased employee dissatisfaction and departures or difficulty in recruiting new employees. If key employees depart or we are unable to recruit and integrate new employees successfully, our business could be negatively impacted.

We have a diverse set of suppliers to help us develop, maintain, and troubleshoot products and services such as wireless and wireline network components, software development services, and billing and customer service support. However, in certain areas such as, billing services, voice, and data communications transport services, wireless or wireline network infrastructure equipment, handsets, other devices, back-office processes and payment processing, there are a limited number of suppliers who can provide adequate support for us, which decreases our flexibility to switch to alternative third parties. Unexpected termination of our arrangement with any of these suppliers or difficulties in renewing our commercial arrangements with them could have a material and adverse effect on our business operations. Our suppliers are also subject to their own risks, including, but not limited to, economic, financial and credit conditions, labor force disruptions, geopolitical tensions, disruptions in global supply chain and the risks of natural catastrophic events (such as earthquakes, floods, hurricanes, storms, heatwaves and fires), energy shortages, power outages, equipment failures, terrorist attacks or other hostile acts, and public health crises, such as the COVID-19 pandemic (the "Pandemic"), which may result in performance below the levels required by their contracts. Our business could be severely disrupted if critical suppliers or service providers fail to comply with their contracts or if we experience delays or service degradation during any transition to a new outsourcing provider or other supplier or if we are required to replace the supplied products or services with those from another source, especially if the replacement becomes necessary on short notice. Any such disruptions could have a material adverse effect on our business, financial condition, and operating results. Further, some of our suppliers may provide services from outside of the United States, which carries additional regulatory and legal obligations. We rely on suppliers to provide us with contractual assurances and to disclose accurate information regarding risks associated with their provision of products or services in accordance with our policies and standards, including our Supplier Code of Conduct and our third-party risk management practices. The failure of our suppliers to comply with our expectations and policies could expose us to additional legal and litigation risks and lead to unexpected contract terminations.

Our business, financial condition, and operating results are sensitive to changes in general economic conditions, including interest rates, consumer credit conditions, consumer debt levels, consumer confidence, unemployment rates, economic growth, energy costs, rates of inflation (or concerns about deflation), supply chain disruptions, impacts of current geopolitical conflict or instability, such as the Ukraine-Russia and Israel-Hamas wars and further escalations thereof, and other macroeconomic factors. The wireless industry, broadly, is dependent on population growth, as a result, we expect the wireless industry's customer growth rate to be moderate in comparison with historical growth rates, leading to ongoing competition for customers. In addition, the Government Commitments place certain limitations on our ability to increase prices, which limits our ability to pass along growing costs to customers. Rising prices for goods, services, and labor due to inflation could adversely impact our margins and/or growth. Our services and device financing plans are available to a broad customer base, a significant segment of which may be vulnerable to weak economic conditions, particularly our subprime customers. We may have greater difficulty in gaining new customers within this segment, and existing customers may be more likely to terminate service and default on device financing plans due to an inability to pay. Weak economic and credit conditions may also adversely impact our suppliers, dealers, and wholesale partners or MVNOs, some of which may file for bankruptcy, or may experience cash flow or liquidity problems, or may be unable to obtain or refinance credit such that they may no longer be able to operate. Any of these could adversely impact our ability to distribute, market, or sell our products and services.

The current sociopolitical environment is characterized by deep complexity, volatility, and polarization on various social and political issues. The increasing intersection of technology and politics has led to rapid and unpredictable shifts in public sentiment. Social media and digital platforms have amplified the voices of various stakeholders, creating the potential for swift change in public opinion and stronger reactions to corporate actions. As a company that sells products and services across the nation to millions of customers, these dynamics increase the risk of potential reputational damage, boycotts, and shifts in consumer behavior that could adversely affect our sales and profitability. In this fluid and volatile sociopolitical environment, our ability to respond effectively, sensitively, and authentically to the expectations and concerns of our customers, employees, and other stakeholders is key to mitigating these risks. If we are unable to manage these challenges effectively, there may be adverse impacts to our business, reputation, financial condition, and operating results.

The wireless communications services industry is highly competitive. As the industry reaches saturation with a relatively fixed pool of customers, competition will likely further intensify, putting pressure on pricing and margins for us and all our competitors. Our ability to attract and retain customers will depend on key factors such as network quality and capacity, customer service excellence, effective marketing strategies, competitive pricing, and compelling value propositions. Additionally, targeted marketing approaches for diverse customer segments, including Prepaid, Postpaid, Business and Government customers, coupled with continuous innovation in products and services, are essential for retaining and expanding our customer base. If we are unable to successfully differentiate our services from our competitors, it would adversely affect our competitive position and ability to grow our business. We have seen and expect to continue to see intense competition in all market segments from traditional Mobile Network Operators (MNOs), such as AT&T and Verizon, particularly as they invest in spectrum, their wireless network and services, and device promotions, and DISH as it continues to build out its wireless network and roll out services. Numerous other smaller and regional MNOs and MVNOs offering wireless services may also compete with us in some markets, including cable providers, such as Comcast, Charter, Cox, and Altice, as they continue to diversify their offerings to include wireless services offered under MVNO agreements. As new products and services emerge, we may also be forced to compete against non-traditional competitors from outside of the wireless communications services industry, such as satellite providers, offering similar connectivity services using alternative technologies. In broadband connectivity services, AT&T and Verizon, as well as numerous other players, such as satellite providers and cable companies, compete for customers in an increasingly competitive environment. If we are unable to compete effectively in attracting and retaining customers, it could negatively impact our business, financial condition, and operating results.