T Mobile US (TMUS) Risk Analysis

We continue to expand our offerings beyond traditional wireless services to include High Speed Internet (including fiber broadband), advertising technology and services, and specialized network solutions, such as network slicing for first responders (T-Priority) and 5G advanced network solutions (ANS) for enterprises. These new ventures require significant capital, expertise, and operational support, and their success depends on factors we cannot fully control or predict. Increased competition, technical challenges, security concerns, operational complexities, or shifting regulatory landscapes could delay product rollouts, inflate costs, or limit adoption rates. Additionally, entering new markets or lines of business may expose us to unfamiliar regulatory requirements, compliance challenges, or damage existing customer relationships. Should these new products and services fail to gain traction, generate expected returns, or deliver value to customers, we could incur substantial expenses without offsetting revenue gains, adversely affecting our business, financial condition, and operating results.

We rely on a variety of intellectual property assets, including patents, copyrights, trademarks, and domains, to maintain our competitiveness. If we are unable to protect our intellectual property due to factors such as changes in US intellectual property laws, the value of our intellectual property may become impaired, which may adversely impact our business and financial results. Additionally, we have faced and will continue to face various litigations alleging that our products or services infringe patents or other intellectual property of third parties, including potential litigation arising from our use of AI. If successful, these litigations could result in an award of financial compensation, including damages or royalties, business disruptions, reputational harm, or an order requiring that we cease offering, selling, and using the relevant products, equipment, services, and network functions. Defending against such litigation is not only costly and time-consuming, but it may also be disruptive to our business operations and divert resources and attention. Furthermore, the outcomes of these litigations are inherently uncertain. Our suppliers and vendors also have and will continue to face intellectual property litigation related to the technology used in the products, equipment, and services they provide to us. If successful, such litigation against our suppliers and vendors might impact their ability to continue to provide the relevant products, equipment, and services to us.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, "Confidential Information"). Additionally, to offer services to our customers and operate our business, we utilize several applications and systems, including those we own and operate, such as our wireless network, as well as others provided to us by third parties, such as cloud service providers and SaaS companies (collectively, "Systems"). We are subject to persistent cyberattacks and threats to our business from bad actors seeking to gain unauthorized access to Confidential Information and compromise Systems to undermine availability or integrity. They are perpetrated by a variety of groups and persons, including nation state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some actors reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable. Cyberattacks against companies like ours are increasing in frequency and scope of potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and detect incidents successfully in every instance. In some cases, these bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information. In other cases, these bad actors obtain unauthorized access to Confidential Information by exploiting insider access or utilizing log in credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means. Other bad actors aim to cause serious operational disruptions to our business and Systems through ransomware or distributed denial of services attacks. Although we regularly work to identify, track and remedy any security vulnerabilities, given the complex nature of our Systems and the tools that are available to us, we may be unable to identify vulnerabilities in a timely manner, or to apply patches or compensating measures that address such vulnerabilities, before bad actors can exploit them. The exploitation of a security vulnerability before patches or measures are applied could materially compromise Confidential Information and Systems. In addition, we routinely rely upon third-party providers whose products and services are used in our business. These third-party providers have experienced, and will continue to experience cyberattacks that involve attempts to expose our Confidential Information and/or to create operational risk that could materially and adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information. Additionally, our Systems include components from third parties or fourth parties we do not control and may have compromises, defects, flaws, or design errors unknown to us. As a result of the previously disclosed cyberattacks in August 2021 and January 2023, we incurred significant costs in connection with, among other things, responding to and resolving mass arbitration claims, multiple class action lawsuits and an FCC investigation. For more information on the foregoing, see "– Contingencies and Litigation – Litigation and Regulatory Matters" in Note 18 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. In addition to the August 2021 cyberattack and the January 2023 cyberattack, we have experienced unrelated non-material incidents involving unauthorized access to certain Confidential Information and Systems. Typically, these incidents have involved attempts to commit fraud by taking control of a customer's phone line, often by exploiting insider access or using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers' private information, including payment information, financial data, social security numbers or passwords, and our intellectual property. Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers. In November 2024, it was publicly reported that a nation-state actor called "Salt Typhoon" successfully infiltrated the telecommunications networks of certain of our competitors to obtain information on their customers. While we have no evidence that any of our Systems or Confidential Information were impacted in any significant way, we may face similar attempts in the future. Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations, including while we adapt complex digital transformation efforts. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers, including through our cybersecurity programs or policies. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers' systems and protocols, we do not have the means to always know or assess the effectiveness of all of our providers' systems and controls. We cannot provide any assurances that actions taken by us, or our third-party providers, including through our cybersecurity programs or policies, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or Systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. We also expect that threat actors will continue to gain sophistication including in the use of tools and techniques (such as AI) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more challenging for us to identify, investigate and recover from future cyberattacks in a timely and effective manner. In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

We and our affiliates are involved in various disputes, governmental and/or regulatory inspections, investigations and proceedings, mass arbitrations and litigation matters. For more information, see "– Contingencies and Litigation – Litigation and Regulatory Matters" in Note 18 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. In addition, we, along with equipment manufacturers and other carriers, are subject to current and potential future lawsuits alleging adverse health effects arising from the use of wireless handsets or from wireless transmission equipment such as cell towers. In addition, the FCC has from time to time gathered data regarding wireless device emissions, and its assessment of the risks associated with using wireless devices may evolve based on its findings. Any of these allegations or changes in risk assessments could result in customers purchasing fewer devices and wireless services, could result in significant legal and regulatory liability, and could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. Such legal proceedings can be complex, costly, and highly disruptive to our business operations by diverting the attention and energy of management and other key personnel. The assessment of the outcome of legal proceedings, including our potential liability, if any, is a highly subjective process that requires judgments about future events that are not within our control. The amounts ultimately received or paid upon settlement or pursuant to final judgment, order or decree may differ materially from amounts accrued in our financial statements. In addition, litigation or similar proceedings could impose restraints on our current or future manner of doing business. Such potential outcomes including judgments, awards, settlements or orders could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

In connection with the products and services we sell, we calculate, collect, and remit various federal, state, and local taxes, fees and regulatory charges ("tax" or "taxes") to numerous federal, state and local governmental authorities, including federal and state USF contributions and common carrier regulatory charges and public safety fees. As many of our service plans offer taxes and fees inclusive, our business results could be adversely impacted by increases in taxes and fees. In addition, we incur and pay state and local transaction taxes and fees on purchases of goods and services used in our business. Tax laws are dynamic and subject to change as new laws are passed and new interpretations of the laws are issued or applied. In many cases, the application of existing, newly enacted or amended tax laws may be uncertain and subject to different interpretations, especially when evaluated against new technologies and telecommunications services, such as broadband internet access and cloud-related services. Legislative changes, administrative interpretations and judicial decisions affecting the scope or application of tax laws could also impact revenue reported and taxes due on tax inclusive plans. Additionally, failure to comply with any of the tax laws could subject us to additional taxes, fines, penalties, or other adverse actions. In the event that federal, state, and/or local municipalities were to significantly increase taxes and regulatory or public safety charges on our network, operations, or services, or seek to impose new taxes or charges, it could have a material adverse effect on our business, financial condition, and operating results.

Our future success depends in substantial part on our ability to attract, recruit, hire, motivate, develop, and retain talented personnel possessing the qualifications, experiences, capabilities and skills we need for all areas of our organization, including our CEO and members of our senior leadership team. Succession planning to ensure effective transfer of knowledge and a seamless transition when key personnel depart is also important to our long-term success. Additionally, as we continue to make significant investments in new technologies and new business areas, we are increasingly dependent on being able to hire and retain technically skilled employees, including those with expertise in AI and machine learning. Both external factors, such as fluctuations in economic and industry conditions, changes in U.S. immigration policies, regulatory changes, political forces and the competitive landscape, and internal factors, such as employee tolerance for changes in our corporate culture, organizational changes, limited remote working opportunities, and our compensation programs, may impact our ability to effectively manage our workforce. Further, employee compensation and benefit costs may increase due to inflationary pressures, and if our compensation does not keep up with inflation or that of our competitors', we may see increased employee dissatisfaction and departures or difficulty in recruiting new employees. If key employees depart or we are unable to recruit and integrate new employees successfully, our business could be negatively impacted.

We have a diverse set of suppliers to help us develop, maintain, and troubleshoot products and services such as wireless and wireline network components, software development services, and billing and customer service support. However, in certain areas such as, billing services, voice, and data communications transport services, wireless or wireline network infrastructure equipment, handsets, other devices, back-office processes and payment processing, there are a limited number of suppliers who can provide adequate support for us, which decreases our flexibility to switch to alternative third parties. Unexpected termination of our arrangement with any of these suppliers or difficulties in renewing our commercial arrangements with them could have a material and adverse effect on our business operations. Our suppliers are also subject to their own risks, including, but not limited to, cybersecurity, economic, financial and credit conditions, labor force disruptions, geopolitical tensions, disruptions in global supply chain and the risks of natural catastrophic events (such as earthquakes, floods, hurricanes, storms, heatwaves and fires), energy shortages, power outages, equipment failures, terrorist attacks or other hostile acts, and public health crises, such as the COVID-19 pandemic, which may result in performance below the levels required by their contracts. Our business could be severely disrupted if critical suppliers or service providers fail to comply with their contracts or if we experience delays or service degradation during any transition to a new outsourcing provider or other supplier or if we are required to replace the supplied products or services with those from another source, especially if the replacement becomes necessary on short notice. Any such disruptions could have a material adverse effect on our business, financial condition, and operating results. Further, some of our suppliers may provide services from outside of the United States, which carries additional regulatory and legal obligations. We rely on suppliers to provide us with contractual assurances and to disclose accurate information regarding risks associated with their provision of products or services in accordance with our policies and standards, including our Supplier Code of Conduct and our third-party risk management practices. The failure of our suppliers to comply with our expectations and policies could expose us to additional legal and litigation risks and lead to unexpected contract terminations. Additionally, we rely on third-party technology partners on various projects and developments. If any of our third-party technology partners terminate or reduce their relationships with us or suspend, limit, or cease their operations, we may not be able to complete such initiatives or achieve the intended results from the partnerships, and our business, reputation, financial condition and results of operations may suffer.

Our business, financial condition, and operating results are sensitive to changes in general economic conditions, including interest rates, consumer credit conditions, consumer debt levels, consumer confidence, unemployment rates, economic growth, energy costs, rates of inflation (or concerns about deflation), supply chain disruptions, impacts of current geopolitical conflict or instability, such as the Ukraine-Russia and Israel-Hamas wars and further escalations thereof, and other macroeconomic factors. The wireless industry, broadly, is dependent on population growth, as a result, we expect the wireless industry's customer growth rate to be moderate in comparison with historical growth rates, leading to ongoing competition for customers. In addition, the Government Commitments place certain limitations on our ability to increase prices, which limits our ability to pass along growing costs to customers. Rising prices for goods, services, and labor due to inflation could adversely impact our margins and/or growth. Our services and device financing plans are available to a broad customer base, a significant segment of which may be vulnerable to weak economic conditions, particularly our subprime customers. We may have greater difficulty in gaining new customers within this segment, and existing customers may be more likely to terminate service and default on device financing plans due to an inability to pay. Weak economic and credit conditions may also adversely impact our suppliers, dealers, wholesale partners or MVNOs, and enterprise and government customers, some of which may file for bankruptcy, or may experience cash flow or liquidity problems, or may be unable to obtain or refinance credit such that they may no longer be able to operate. Any of these could adversely impact our ability to distribute, market, or sell our products and services.

The current sociopolitical environment is characterized by deep complexity, volatility, and polarization on various social and political issues. The increasing intersection of technology and politics has led to rapid and unpredictable shifts in public sentiment. Social media and digital platforms have amplified the voices of various stakeholders, creating the potential for swift change in public opinion and stronger reactions to corporate actions. As a company that sells products and services across the nation to millions of customers, these dynamics increase the risk of potential reputational damage, boycotts, and shifts in consumer behavior that could adversely affect our brand, sales and profitability. Our ability to respond effectively, sensitively, and authentically to the expectations and concerns of our customers, employees, and other stakeholders is key to mitigating these risks. If we are unable to manage these challenges effectively, there may be adverse impacts to our business, reputation, financial condition, and operating results. Additionally, we are subject to emerging and evolving regulatory requirements and frameworks regarding environmental, social and governance matters, including potential new or revised disclosure rules proposed by the SEC and recently enacted or proposed legislation in jurisdictions such as California. The ultimate scope of these regulations may change as they are finalized, and they may not be uniform across jurisdictions. Meeting these obligations may require significant investments of time, capital, and personnel.

The wireless communications services industry is highly competitive. As the industry reaches saturation, competition in all market segments, including prepaid, postpaid, enterprise and government customers will likely further intensify, putting pressure on pricing and/or margins for us and all our competitors. Our ability to attract and retain customers will depend on multiple factors, such as network quality and capacity, customer service excellence, effective marketing strategies, competitive pricing, compelling value propositions, and distribution and logistics capabilities. Additionally, targeted marketing approaches for diverse customer segments, coupled with continuous innovation in products and services, are essential for retaining and expanding our customer base. If we are unable to successfully differentiate our services from our competitors, it would adversely affect our competitive position and ability to grow our business. We have seen and expect to continue to see intense competition in all market segments from traditional Mobile Network Operators ("MNOs"), such as AT&T and Verizon, who have each invested heavily in spectrum, their wireless networks, and services and device promotions, and DISH, as it continues to build out its wireless network and roll out services. Numerous other regional MNOs and MVNOs offering wireless services may also compete with us in some markets, including cable providers, such as Comcast, Charter, Cox, and Altice, as they continue to diversify their offerings to include wireless services offered under MVNO agreements. As new products and services emerge, we may also be forced to compete against non-traditional competitors from outside of the wireless communications services industry, such as satellite providers, offering similar connectivity services using alternative technologies. In the market for broadband services, traditional cable providers, AT&T, Verizon, and other players such as satellite and fiber providers, all compete for customers. To complement our fixed wireless service, we have agreed to enter into joint venture agreements aimed at establishing a robust fiber wireline network in certain geographic regions that we believe will complement our fixed wireless services in those areas. However, these partnerships also involve inherent risks. See "Any acquisition, divestiture, investment, joint venture or merger may subject us to significant risks, any of which may harm our business" for further discussions of such risks. If we are unable to compete effectively in attracting and retaining customers in markets where we operate, it could negatively impact our business, financial condition, and operating results.