−Removed: Other than the updated risk factors below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2021.
−Removed: Risks Related to Our Business and the Wireless Industry
−Removed: We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties.
+Added: Other than the updated risk factor below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2022.
+Added: We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business.
Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”).
−Removed: We are subject to persistent cyberattacks and threats to our networks, systems, and supply chain from a variety of bad actors, many of whom attempt to gain access to and compromise Confidential Information by exploiting bugs, errors, misconfigurations or other vulnerabilities in our networks and other systems (including purchased and third-party systems) or by engaging in credential harvesting or social engineering.
−Removed: In some cases, these bad actors may obtain unauthorized access to Confidential Information utilizing credentials taken from our customers, employees, or third parties.
−Removed: Other bad actors aim to cause serious operational disruptions to our business or networks through other means, such as through ransomware or distributed denial of services attacks.
+Added: Additionally, to offer services to our customers and operate our business, we utilize a number of networks and systems, including those we own and operate as well as others provided by third-party providers, such as cloud services (collectively, “Systems”).
+Added: We are subject to persistent cyberattacks and threats to our business from a variety of bad actors, many of whom attempt to gain unauthorized access to and compromise Confidential Information and Systems.
+Added: In some cases, the bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information.
+Added: In other cases, these bad actors may obtain unauthorized access to Confidential Information utilizing credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means.
+Added: Other bad actors aim to cause serious operational disruptions to our business through ransomware or distributed denial of services attacks.
Cyberattacks against companies like ours have increased in frequency and potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and/or detect incidents successfully in every instance.
1 unchanged sentence
Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments.
−Removed: In addition, we routinely provide certain Confidential Information to third-party providers whose products and services are used in our business operations, including as part of our IT systems, such as cloud services.
+Added: In addition, we routinely rely upon third-party providers whose products and services are used in our business.
These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information.
1 unchanged sentence
With the assistance of outside cybersecurity experts, we located and closed the unauthorized access to our systems and identified current, former, and prospective customers whose information was impacted and notified them, consistent with state and federal requirements.
−Removed: We have incurred certain cyberattack-related expenses, including costs to remediate the attack, provide additional customer support and enhance customer protection, and expect to incur additional expense in future periods resulting from the attack.
−Removed: For more information, see “Cyberattack” in the Overview section of MD&A.
+Added: We have incurred certain
+Added: cyberattack-related expenses, including costs to remediate the attack, provide additional customer support and enhance customer protection, and expect to incur additional expense in future periods resulting from the attack.
+Added: For more information, see “Recent Cyberattacks” in the Overview section of our Management’s Discussion and Analysis of Financial Condition and Results of Operations.
As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation.
−Removed: For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 14 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements.” As a result of the August 2021 cyberattack, we may incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.
−Removed: In addition to the August 2021 cyberattack, we have experienced other unrelated immaterial incidents involving unauthorized access to certain Confidential Information.
+Added: For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 13 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.
+Added: In January 2023, we disclosed that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization.
+Added: Based on our investigation, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features.
+Added: The result from our investigation indicates that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set.
+Added: We believe that the bad actor first retrieved data through the impacted API starting on or around November 25, 2022.
+Added: We have notified individuals whose information was impacted consistent with state and federal requirements.
+Added: As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.
+Added: In addition to the recent cyberattacks, we have experienced other unrelated immaterial incidents involving unauthorized access to certain Confidential Information.
Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by using compromised credentials.
In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property.
+Added: Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers.
Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations.
−Removed: These preventative actions require the investment of significant resources and management
−Removed: time and attention.
+Added: These preventative actions require the investment of significant resources and management time and attention.
Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers.
2 unchanged sentences
We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers.
−Removed: Our inability to protect Confidential Information or to prevent operational disruptions from future cyberattacks may have a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.
−Removed: Risks Related to Our Indebtedness
−Removed: Our substantial level of indebtedness could adversely affect our business flexibility, ability to service our debt, and increase our borrowing costs.
−Removed: We have, and we expect that we will continue to have, a substantial amount of debt.
−Removed: Our substantial level of indebtedness could have the effect of, among other things, reducing our flexibility in responding to changing business, economic, market and industry conditions and increasing the amount of cash required to service our debt.
−Removed: In addition, this level of indebtedness may also reduce funds available for capital expenditures, any board-approved share repurchases and other activities.
−Removed: Those impacts may put us at a competitive disadvantage relative to other companies with lower debt levels.
−Removed: Further, we may need to incur substantial additional indebtedness in the future, subject to the restrictions contained in our debt instruments, if any, which could increase the risks associated with our capital structure.
−Removed: Our ability to service our substantial debt obligations will depend on future performance, which will be affected by business, economic, market and industry conditions and other factors, including our ability to achieve the expected benefits of the Transactions.
−Removed: There is no guarantee that we will be able to generate sufficient cash flow to service our debt obligations when due.
−Removed: If we are unable to meet such obligations or fail to comply with the financial and other restrictive covenants contained in the agreements governing such debt obligations, we may be required to refinance all or part of our debt, sell important strategic assets at unfavorable prices or make additional borrowings.
−Removed: We may not be able to, at any given time, refinance our debt, sell assets or make additional borrowings on commercially reasonable terms or at all, which could have a material adverse effect on our business, financial condition and operating results.
−Removed: Changes in credit market conditions could adversely affect our ability to raise debt favorably.
−Removed: Instability in the global financial markets, inflation, policies of various governmental and regulatory agencies, including changes in monetary policy and interest rates, and other general economic conditions could lead to volatility in the credit and equity markets.
−Removed: This volatility could limit our access to the capital markets, leading to higher borrowing costs or, in some cases, the inability to obtain financing on terms that are acceptable to us or at all.
−Removed: In addition, any hedging agreements we have and may continue to enter into to limit our exposure to interest rate increases or foreign currency fluctuations may not offer complete protection from these risks or may be unsuccessful, and consequently may effectively increase the interest rate we pay on our debt or the exchange rate with respect to any debt we may incur in a foreign currency, and any portion not subject to such hedging agreements would have full exposure to interest rate increases or foreign currency fluctuations, as applicable.
−Removed: If any financial institutions that are parties to our hedging agreements were to default on their payment obligations to us, declare bankruptcy or become insolvent, we would be unhedged against the underlying exposures.
−Removed: Any posting of collateral by us under our hedging agreements and the modification or termination of any of our hedging agreements could negatively impact our liquidity or other financial metrics.
−Removed: Any of these risks could have a material adverse effect on our business, financial condition and operating results.
−Removed: The agreements governing our indebtedness and other financings include restrictive covenants that limit our operating
−Removed: The agreements governing our indebtedness and other financings impose operating and financial restrictions.
−Removed: These restrictions, subject in certain cases to customary baskets, exceptions and maintenance and incurrence-based financial tests, together with our debt service obligations, may limit our ability to engage in transactions and pursue strategic business opportunities.
−Removed: These restrictions could limit our ability to obtain debt financing, refinance or pay principal on our outstanding indebtedness,
−Removed: complete acquisitions for cash or indebtedness or react to business, economic, market and industry conditions and other changes in our operating environment or the economy.
−Removed: Any future indebtedness that we incur may contain similar or more restrictive covenants.
−Removed: Any failure to comply with the restrictions of our debt agreements may result in an event of default under these agreements, which in turn may result in defaults or acceleration of obligations under these and other agreements, giving our lenders the right to terminate the commitments they had made or the right to require us to repay all amounts then outstanding plus any interest, fees, penalties or premiums.
−Removed: An event of default may also compel us to sell certain assets securing indebtedness under certain of these agreements.
−Removed: Credit rating downgrades and/or inability to access debt markets could adversely affect our business, cash flows, financial condition and operating results.
−Removed: Credit ratings impact the cost and availability of future borrowings and, as a result, cost of capital.
−Removed: Our current ratings reflect each rating agency’s opinion of our financial strength, operating performance and ability to meet our debt obligations.
−Removed: Our capital structure and business model are reliant on continued access to debt markets.
−Removed: Each rating agency reviews our ratings periodically, and there can be no assurance that such ratings will be maintained in the future.
−Removed: A downgrade in our corporate rating and/or our issued debt ratings could impact our ability to access debt markets and adversely affect our business, cash flows, financial condition and operating results.
−Removed: Risks Related to Legal and Regulatory Matters
−Removed: Unfavorable outcomes of legal proceedings may adversely affect our business, reputation, financial condition, cash flows and operating results.
−Removed: We and our affiliates are involved in various disputes, governmental and/or regulatory inspections, investigations and proceedings, mass arbitrations and litigation matters.
−Removed: Such legal proceedings can be complex, costly, and highly disruptive to our business operations by diverting the attention and energy of management and other key personnel.
−Removed: In connection with the Transactions, we became subject to a number of legal proceedings, including a putative shareholder class action and derivative lawsuit and a putative antitrust class action.
−Removed: For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 14 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements.
−Removed: It is possible that stockholders of T-Mobile and/or Sprint may file additional putative class action lawsuits or shareholder derivative actions against the Company and the legacy T-Mobile board of directors and/or the legacy Sprint board of directors.
−Removed: Among other remedies, these stockholders could seek damages.
−Removed: The outcome of any litigation is uncertain and any such potential lawsuits could result in substantial costs and may be costly and distracting to management.
−Removed: Additionally, on April 1, 2020, in connection with the closing of the Merger, we assumed the contingencies and litigation matters of Sprint.
−Removed: Those matters include a wide variety of disputes, claims, government agency investigations and enforcement actions and other proceedings.
−Removed: Unfavorable resolution of these matters could require making additional reimbursements and paying additional fines and penalties.
−Removed: On February 28, 2020, we received a Notice of Apparent Liability for Forfeiture and Admonishment from the FCC, which proposed a penalty against us for allegedly violating Section 222 of the Communications Act and the FCC’s regulations governing the privacy of customer information.
−Removed: We recorded an accrual for an estimated payment amount as of March 31, 2020, which was included in Accounts payable and accrued liabilities on our Consolidated Balance Sheets.
−Removed: As a result of the August 2021 cyberattack, we are subject to numerous lawsuits, including consolidated class action lawsuits seeking unspecified monetary damages, mass consumer arbitrations, a shareholder derivative lawsuit and inquiries by various government agencies, law enforcement and other governmental authorities, and we may be subject to further regulatory inquiries and private litigation.
−Removed: We are cooperating fully with regulators and vigorously defending against the class actions and other lawsuits.
−Removed: On July 22, 2022, we entered into an agreement to settle the consolidated class action lawsuit.
−Removed: On July 26, 2022, we received preliminary approval of the proposed settlement, which remains subject to final court approval.
−Removed: Final court approval of the terms of the settlement is expected as early as January 2023 but could be delayed by appeals or other proceedings.
−Removed: If approved by the court, under the terms of the proposed settlement, we would pay an aggregate of $350 million to fund claims submitted by class members, the legal fees of plaintiffs’ counsel and the costs of administering the settlement.
−Removed: We would also commit to an aggregate incremental spend of $150 million for data security and related technology in 2022 and 2023.
−Removed: In connection with the proposed class action settlement and other settlements of separate consumer claims that have been previously completed or are currently pending , we recorded a total pre-tax charge of approximately $400 million in the second quarter of 2022.
−Removed: In light of the inherent uncertainties involved in such matters and based on the information currently available
−Removed: to us, we believe it is reasonably possible that we could incur additional losses associated with these proceedings and inquiries, and we will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable.
−Removed: Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries related to the August 2021 cyberattack, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be significant and have a material adverse impact on our business, reputation, financial condition, cash flows and operating results.
−Removed: We, along with equipment manufacturers and other carriers, are subject to current and potential future lawsuits alleging adverse health effects arising from the use of wireless handsets or from wireless transmission equipment such as cell towers.
−Removed: In addition, the FCC has from time to time gathered data regarding wireless device emissions, and its assessment of the risks associated with using wireless devices may evolve based on its findings.
−Removed: Any of these allegations or changes in risk assessments could result in customers purchasing fewer devices and wireless services, could result in significant legal and regulatory liability, and could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.
−Removed: The assessment of the outcome of legal proceedings, including our potential liability, if any, is a highly subjective process that requires judgments about future events that are not within our control.
−Removed: The amounts ultimately received or paid upon settlement or pursuant to final judgment, order or decree may differ materially from amounts accrued in our financial statements.
−Removed: In addition, litigation or similar proceedings could impose restraints on our current or future manner of doing business.
−Removed: Such potential outcomes including judgments, awards, settlements or orders could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.
−Removed: Risks Related to Ownership of Our Common Stock
−Removed: We cannot guarantee that our 2022 Stock Repurchase Program will be fully consummated or that our 2022 Stock Repurchase Program will enhance long-term stockholder value.
−Removed: Our Board of Directors has authorized our 2022 Stock Repurchase Program for up to $14.0 billion of the Company’s common stock through September 30, 2023, including up to $3.0 billion through 2022, with $669 million spent by the Company on share repurchases as of September 30, 2022.
−Removed: Any share repurchases will depend upon, among other factors, our cash balances and potential future capital requirements, our results of operations and financial condition, our ability to access capital markets, our priorities for the use of cash for other purposes, the price of our common stock, and other factors that we may deem relevant.
−Removed: The existence of the 2022 Stock Repurchase Program could cause our stock price, in certain cases, to be higher or lower than it otherwise would be and could potentially reduce the market liquidity or have other unintended consequences for our stock.
−Removed: We can provide no assurance that we will repurchase shares of our common stock at favorable prices, if at all.
−Removed: Although the program is intended to enhance long-term stockholder value, there is no assurance it will do so.
−Removed: In addition, the 2022 Stock Repurchase Program does not obligate the Company to acquire any particular amount of common stock.
−Removed: The 2022 Stock Repurchase Program may be suspended or discontinued, or the amount to be spent by the Company to repurchase shares could be reduced, at any time at the Company’s discretion.
−Removed: Any decision to reduce or discontinue repurchasing shares of our common stock pursuant to our 2022 Stock Repurchase Program could cause the market price for our common stock to decline and may negatively impact our reputation and investor confidence in us.
+Added: If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.