What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-04-28 compared with 2025-10-23 · 35 added, 61 removed, 0 unchanged (100% of the section changed)

Other than the updated risk factors below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2024.

We rely on highly skilled personnel throughout all levels of our business.

Our business could be harmed if we are unable to retain or motivate key personnel, hire a sufficient number of qualified new personnel, or maintain our corporate culture.

Our future success depends in substantial part on our ability to attract, recruit, hire, motivate, develop, and retain talented personnel possessing the qualifications, experiences, capabilities and skills we need for all areas of our organization, including our CEO and members of our senior leadership team.

Succession planning to ensure effective transfer of knowledge and a seamless transition when key personnel depart is also important to our long-term success.

In September 2025, we announced that on November 1, 2025, G.

Michael Sievert would retire as our Chief Executive Officer and continue to serve as Vice Chairman of the Company and Vice Chairman of our Board of Directors, and Srinivasan Gopalan would serve as our Chief Executive Officer.

Our ability to execute our business strategies and retain key executives may be adversely affected by the transition.

Additionally, as we continue to make significant investments in new technologies and new business areas, we are increasingly dependent on being able to hire and retain technically skilled employees, including those with expertise in AI and machine learning.

Both external factors, such as fluctuations in economic and industry conditions, changes in U.S.

immigration policies, regulatory changes, political forces and the competitive landscape, and internal factors, such as employee tolerance for changes in our corporate culture, organizational changes, limited remote working opportunities, and our compensation programs, may impact our ability to effectively manage our workforce.

Further, employee compensation and benefit costs may increase due to inflationary pressures, and if our compensation does not keep up with inflation or that of our competitors’, we may see increased employee dissatisfaction and departures or difficulty in recruiting new employees.

If key employees depart or we are unable to recruit and integrate new employees successfully, our business could be negatively impacted.

Any acquisition, divestiture, investment, joint venture or merger may subject us to significant risks, any of which may harm our business.

We may pursue acquisitions of, investments in, or joint ventures or mergers with, other companies, or the acquisition of technologies, services, products or other assets that we believe would complement or expand our business.

We may also elect to divest some of our assets to third parties.

Some of these potential transactions could be significant relative to the size of our business and operations.

Any such transaction would involve a number of risks and could present financial, managerial and operational challenges, including:

• diversion of management attention from running our existing business;

• increased costs to integrate the networks, spectrum, technology, personnel, customer base, distributors and business partners and business practices of the company involved in any such transaction with our business;

• increased interest expense and leverage or limits on other uses of cash;

• potential loss of talent during integration due to differences in culture, locations, or other factors;

• difficulties in effectively integrating the financial, operational and sustainability systems of the business involved in any such transaction into (or supplanting such systems with) our financial, operational and sustainability reporting infrastructure and internal control framework in an effective and timely manner;

• risks of entering markets in which the Company has no or limited experience and where competitors have stronger market positions;

• to the extent any acquired business has any international operations, potential exposures to risks associated with maintaining and expanding such operations, including unfavorable and uncertain regulatory, political, economic, tax and labor conditions;

• potential exposure to material liabilities not discovered in the due diligence process or as a result of any litigation arising in connection with any such transaction;

• significant transaction-related expenses in connection with any such transaction, whether consummated or not;

• risks related to our ability to obtain any required regulatory approvals necessary to consummate any such transaction;

• any business, technology, service, or product involved in any such transaction may significantly under-perform relative to our expectations, and we may not achieve the benefits we expect from the transaction, which could, among other things, also result in a write-down of goodwill and other intangible assets associated with such transaction.

We formed joint ventures aimed at establishing a robust fiber broadband network that complements our fixed wireless services.

Differences in views among the joint venture participants may result in delayed decisions or disputes.

Operating through joint ventures in which we do not hold a majority ownership interest results in us having limited control over many decisions made with respect to the businesses of the joint ventures.

We also cannot control the actions of our joint venture partners.

These joint ventures may not be subject to the same requirements regarding internal controls and internal control over financial reporting that we follow.

As a result, internal control problems may arise with respect to these joint ventures.

Any of these risks could have a material adverse effect on our business, financial condition and results of operations and could also affect our reputation.

Additionally, in connection with our Sprint Merger and related transactions, including the acquisition by DISH Network Corporation (“DISH”) of certain prepaid wireless business (the “Prepaid Transaction”), we agreed to fulfill various government commitments (the “Government Commitments”), including, among others, extensive 5G network build-out, delivering high-speed wireless services to the vast majority of Americans and marketing our in-home fixed wireless product to households where spectrum capacity is sufficient, as well as commitments related to national security, pricing and availability of rate plans.

These Government Commitments materially increased our compliance obligations and could result in additional expenses and/or penalties in the future.

In connection with the Prepaid Transaction, we and DISH entered into certain arrangements, including a Master Network Services Agreement (the “MNSA”), pursuant to which we provide DISH, for a period of seven years, network services for certain end users and infrastructure mobile network operator services to assist in the access and integration of the DISH network.

Any failure to fulfill our obligations under the Government Commitments and the MNSA in a timely manner could result in substantial fines, penalties, or other legal and administrative actions, liabilities, and reputational harm.

Economic, political and market conditions may adversely affect our business, financial condition, and operating results.

Our business, financial condition, and operating results are affected by changes in general economic conditions, including interest rates, consumer credit conditions, consumer debt levels, consumer confidence, unemployment rates, economic growth, tariffs and trade restrictions, fluctuations in global currencies, immigration policies, energy costs, rates of inflation (or concerns about deflation), supply chain disruptions, impacts of current geopolitical conflict or instability, such as the Ukraine-Russia, Iran-Israel and Israel-Hamas wars and further escalations thereof, and other macroeconomic factors.

The wireless industry, broadly, is dependent on population growth, including growth in the immigrant population.

As a result, we expect the wireless industry’s customer growth rate to be moderate in comparison with historical growth rates, leading to ongoing competition for customers.

In addition, the Government Commitments place certain limitations on our ability to increase prices, which limits our ability to pass along growing costs to customers.

Rising prices for goods, services, and labor due to inflation, including inflation resulting from higher tariffs, restrictions and other economic disincentives to trade, could adversely impact our margins and/or growth.

Our services and device financing plans are available to a broad customer base, a significant segment of which may be vulnerable to weak economic conditions, particularly our subprime customers.

We may have greater difficulty in gaining new customers within this segment, and existing customers may be more likely to terminate service and default on device financing plans due to an inability to pay.

Weak economic and credit conditions may also adversely impact our suppliers, dealers, wholesale partners or MVNOs, and enterprise and government customers, some of which may file for bankruptcy, or may experience cash flow or liquidity problems, or may be unable to obtain or refinance credit such that they may no longer be able to operate.

Any of these could adversely impact our ability to distribute, market, or sell our products and services.

Changes to trade policies, including higher tariffs, restrictions and other economic disincentives to trade, may lead to operational delays, higher procurement and operational costs, and regulatory and compliance complexities, resulting in supply chain disruptions and higher prices and lower demand for devices and services we sell.

As a provider of telecommunications services, we depend on suppliers to provide us, directly or through other suppliers, with items such as equipment for our network, handsets, tablets, accessories, other mobile communication devices, other components and raw materials.

Changes or proposed changes in U.S.

or other countries’ trade policies that result in higher tariffs, restrictions and other economic disincentives to international trade may materially increase the costs we incur in developing, deploying and maintaining our network and offering products and services to our customers.

A certain portion of the increased costs may be absorbed by certain suppliers, but some suppliers may struggle to absorb the increased costs, especially over the long term, potentially leading to supply disruptions or cost pass-throughs to us, which may lead to us increasing the prices we charge our customers.

In addition, rapid changes in trade policies may negatively affect procurement timelines and supplier relationships and may introduce new compliance requirements.

We may face potential delays in sourcing critical equipment due to customs clearance and supply chain bottlenecks, and material changes to cost structures could pressure our expenses and customer pricing.

Our attempts to mitigate potential disruptions to our supply chain and offset procurement and operational cost pressures, such as through alternative sourcing and/or increases in the selling prices of some of our products and services, may not be successful.

Higher product or service prices for our customers may make it more difficult to attract new customers or cause increases in customer churn.

Furthermore, we may not be able to offset any cost increases through productivity and cost-saving initiatives.

To the extent that cost increases result in significant increases in our expenditures, or if our price increases are not sufficient to offset these increased costs adequately or in a timely manner, and/or if our revenues decrease, our business, financial condition or operating results may be adversely affected.

Other than the updated risk factor below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2025.

We have experienced cyberattacks and may experience disruptions, data loss and other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account, and payment information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”).

Additionally, to offer services to our customers and operate our business, we utilize several applications and systems, including those we own and operate, such as our wireless network, as well as others provided to us by third parties, such as cloud service providers and SaaS companies (collectively, “Systems”).

We are subject to persistent cyberattacks and threats to our business from bad actors seeking to gain unauthorized access to Confidential Information and to compromise Systems.

They are perpetrated by a variety of groups and persons, including nation state-sponsored parties, malicious actors, employees, contractors, and other third parties.

Some of these bad actors reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable.

Cyberattacks against companies like ours are increasing in frequency and scope of potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and detect incidents successfully in every instance.

In some cases, these bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information.

In other cases, these bad actors obtain unauthorized access to Confidential Information by exploiting insider access or utilizing login credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means.

Other bad actors aim to cause serious operational disruptions to our business and Systems through ransomware or distributed denial of service attacks.

Moreover, the amount and scope of insurance that we maintain against losses resulting from any such incidents or security breaches may not be sufficient to cover our losses or otherwise adequately compensate us for any disruptions to our business that may result.

Although we regularly work to identify, track, and remedy security vulnerabilities, given the complex nature of our Systems and the tools that are available to us, we may be unable to identify vulnerabilities in a timely manner, or to apply patches or compensating measures that address such vulnerabilities, before bad actors can exploit them.

The exploitation of a security vulnerability before patches or measures are applied could materially compromise Confidential Information and Systems.

In addition, we routinely rely upon third-party providers whose products and services are used in our business.

These third-party providers have experienced, and will continue to experience, cyberattacks that involve attempts to access our Confidential Information and/or to create operational risk that could materially and adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information.

Additionally, our Systems include components from third parties or fourth parties we do not control and may have compromises, defects, flaws, or design errors unknown to us.

As a result of the previously disclosed cyberattacks in August 2021 and January 2023, we incurred significant costs in connection with, among other things, responding to and resolving mass arbitration claims, multiple class action lawsuits, and an FCC investigation.

For more information on the foregoing, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 1 3 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements.

In addition to the August 2021 cyberattack and the January 2023 cyberattack, we have experienced unrelated, non-material incidents involving unauthorized access to certain Confidential Information and Systems.

Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by exploiting insider access or using compromised credentials.

In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including payment information, financial data, Social Security numbers or passwords, and our intellectual

Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers.

Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations, including while we adapt complex digital efforts.

These preventative actions require the investment of significant resources and management time and attention.

Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers, including through our cybersecurity programs or policies.

While T-Mobile may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to always know or assess the effectiveness of all of our providers’ systems and controls.

We cannot provide any assurances that actions taken by us, or our third-party providers, including through our cybersecurity programs or policies, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or Systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all.

We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers.

We expect threat actors to continue to increase in sophistication, including through the use of increasingly advanced AI tools, which may accelerate the identification and exploitation of vulnerabilities, enable evasion of security controls, and reduce the time between discovery and attempted exploitation.

Although AI may also enhance defensive capabilities, the pace at which vulnerabilities can be identified and weaponized may outstrip our ability, and that of our third-party providers, to test and deploy patches or other mitigating measures across complex systems.

Efforts to accelerate remediation may also increase the risk of operational disruptions or system instability, and the continued development and integration of AI may introduce new and evolving cybersecurity risks.

These dynamics may heighten our exposure to cybersecurity incidents and related adverse impacts on our business, reputation, financial condition, and operating results.

In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities or unsophisticated security measures, which expose us to significant cybersecurity, operational, and financial risks.

If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors