T-Mobile US 10-Q 2022-03-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

☒ QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended March 31, 2022

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number: 1-33409

T-MOBILE US, INC.

(Exact name of registrant as specified in its charter)

12920 SE 38th Street

Bellevue, Washington

(Address of principal executive offices)

98006-1350

(Zip Code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

Indicate the number of shares outstanding of each of the issuer’s classes of common stock, as of the latest practicable date.

T-Mobile US, Inc.

Form 10-Q

For the Quarter Ended March 31, 2022

Table of Contents

Index for Notes to the Condensed Consolidated Financial Statements

PART I. FINANCIAL INFORMATION

T-Mobile US, Inc.

Condensed Consolidated Balance Sheets

(Unaudited)

The accompanying notes are an integral part of these condensed consolidated financial statements.

Index for Notes to the Condensed Consolidated Financial Statements

T-Mobile US, Inc.

Condensed Consolidated Statements of Comprehensive Income

(Unaudited)

Showing the first 8K of 143K characters. Open the full section

Cautionary Statement Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q (“Form 10-Q”) of T-Mobile US, Inc. (“T-Mobile,” “we,” “our,” “us” or the “Company”) includes forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements, other than statements of historical fact, including information concerning our future results of operations, are forward-looking statements. These forward-looking statements are generally identified by the words “anticipate,” “believe,” “estimate,” “expect,” “intend,” “may,” “could” or similar expressions. Forward-looking statements are based on current expectations and assumptions, which are subject to risks and uncertainties that may cause actual results to differ materially from the forward-looking statements. The following important factors, along with the Risk Factors included in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2021 and Part II, Item 1A of this Form 10-Q, could affect future results and cause those results to differ materially from those expressed in the forward-looking statements:

• adverse impact caused by the COVID-19 pandemic (the “Pandemic”), including supply chain shortages;

• competition, industry consolidation and changes in the market for wireless services;

• disruption, data loss or other security breaches, such as the criminal cyberattack we became aware of in August 2021;

• our inability to take advantage of technological developments on a timely basis;

• our inability to retain or motivate key personnel, hire qualified personnel or maintain our corporate culture;

• system failures and business disruptions, allowing for unauthorized use of or interference with our network and other systems;

• the scarcity and cost of additional wireless spectrum, and regulations relating to spectrum use;

• the impacts of the actions we have taken and conditions we have agreed to in connection with the regulatory proceedings and approvals of the Transactions (as defined below), including the acquisition by DISH Network Corporation (“DISH”) of the prepaid wireless business operated under the Boost Mobile and Sprint prepaid brands (excluding the Assurance brand Lifeline customers and the prepaid wireless customers of Shenandoah Personal Communications Company LLC and Swiftel Communications, Inc.), including customer accounts, inventory, contracts, intellectual property and certain other specified assets, and the assumption of certain related liabilities (collectively, the “Prepaid Transaction”), the complaint and proposed final judgment agreed to by us, Deutsche Telekom AG (“DT”), Sprint Corporation, now known as Sprint LLC (“Sprint”), SoftBank Group Corp. (“SoftBank”) and DISH with the U.S. District Court for the District of Columbia, which was approved by the Court on April 1, 2020, the proposed commitments filed with the Secretary of the Federal Communications Commission (“FCC”), which we announced on May 20, 2019, certain national security commitments and undertakings, and any other commitments or undertakings entered into, including but not limited to, those we have made to certain states and nongovernmental organizations (collectively, the “Government Commitments”), and the challenges in satisfying the Government Commitments in the required time frames and the significant cumulative costs incurred in tracking and monitoring compliance;

• adverse economic, political or market conditions in the U.S. and international markets, including changes resulting from increases in inflation, impacts of current geopolitical instability caused by the war in Ukraine, and those caused by the Pandemic;

• our inability to manage the ongoing commercial and transition services arrangements entered into in connection with the Prepaid Transaction, and known or unknown liabilities arising in connection therewith;

• the effects of any future acquisition, investment, or merger involving us;

• any disruption or failure of our third parties (including key suppliers) to provide products or services for the operation of our business;

• our substantial level of indebtedness and our inability to service our debt obligations in accordance with their terms or to comply with the restrictive covenants contained therein;

• changes in the credit market conditions, credit rating downgrades or an inability to access debt markets;

• restrictive covenants including the agreements governing our indebtedness and other financings;

• the risk of future material weaknesses we may identify while we continue to work to integrate and align policies, principles and practices of the two companies following the Merger (as defined below), or any other failure by us to maintain effective internal controls, and the resulting significant costs and reputational damage;

• any changes in regulations or in the regulatory framework under which we operate;

• laws and regulations relating to the handling of privacy and data protection;

• unfavorable outcomes of existing or future legal proceedings, including these proceedings and inquiries relating to the criminal cyberattack we became aware of in August 2021;

• the possibility that we may be unable to adequately protect our intellectual property rights or be accused of infringing the intellectual property rights of others;

• our offering of regulated financial services products and exposure to a wide variety of state and federal regulations;

• new or amended tax laws or regulations or administrative interpretations and judicial decisions affecting the scope or application of tax laws or regulations;

• our exclusive forum provision as provided in our Certificate of Incorporation;

• interests of our significant stockholders that may differ from the interests of other stockholders;

• future sales of our common stock by DT and SoftBank and our inability to attract additional equity financing outside the United States due to foreign ownership limitations by the FCC;

• failure to realize the expected benefits and synergies of the merger (the “Merger”) with Sprint, pursuant to the Business Combination Agreement with Sprint and the other parties named therein (as amended, the “Business Combination Agreement”) and the other transactions contemplated by the Business Combination Agreement (collectively, the “Transactions”) in the expected time frames or in the amounts anticipated;

• any delay and costs of, or difficulties in, integrating our business and Sprint’s business and operations, and unexpected additional operating costs, customer loss and business disruptions, including challenges in maintaining relationships with employees, customers, suppliers or vendors; and

• unanticipated difficulties, disruption, or significant delays in our long-term strategy to migrate Sprint’s legacy customers onto T-Mobile’s existing billing platforms.

Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements. We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law.

Investors and others should note that we announce material information to our investors using our investor relations website (https://investor.t-mobile.com), newsroom website (https://t-mobile.com/news), press releases, SEC filings and public conference calls and webcasts. We intend to also use certain social media accounts as means of disclosing information about us and our services and for complying with our disclosure obligations under Regulation FD (the @TMobileIR Twitter account (https://twitter.com/TMobileIR), the @MikeSievert Twitter account (https://twitter.com/MikeSievert), which Mr. Sievert also uses as a means for personal communications and observations, and the @TMobileCFO Twitter Account (https://twitter.com/tmobilecfo) and our Chief Financial Officer’s LinkedIn account

Showing the first 8K of 176K characters. Open the full section

There have been no material changes to the market risk as previously disclosed in Part II, Item 7A of our Annual Report on Form 10-K for the year ended December 31, 2021.

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures designed to ensure information required to be disclosed in our periodic reports filed or submitted under the Exchange Act, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Our disclosure controls include the use of a Disclosure Committee which is comprised of representatives from our Accounting, Legal, Treasury, Technology, Risk Management, Government Affairs and Investor Relations functions and are designed to ensure that information required to be disclosed in the reports we file or submit under the Exchange Act is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosure.

Under the supervision and with the participation of our management, including our Chief Executive Officer and our Chief Financial Officer, we carried out an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act. Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective, as of the end of the period covered by this Form 10-Q.

The certifications required by Section 302 of the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) are filed as Exhibits 31.1 and 31.2, respectively, to this Form 10-Q.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act, during our most recently completed fiscal quarter that materially affected or are reasonably likely to materially affect our internal control over financial reporting.

PART II.

Item 1. Legal Proceedings

For more information regarding the legal proceedings in which we are involved, see Note 11 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements.

Other than the updated risk factor below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2021.

We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”). We are subject to persistent cyberattacks and threats to our networks, systems, and supply chain from a variety of bad actors, many of whom attempt to gain access to and compromise Confidential Information by exploiting bugs, errors, misconfigurations or other vulnerabilities in our networks and other systems (including purchased and third-party systems) or engaging in credential harvesting or social engineering. In some cases, these bad actors may obtain unauthorized access to Confidential Information utilizing credentials taken from our customers, employees, or third parties. Other bad actors aim to cause serious operational disruptions to our business or networks through other means, such as through ransomware or distributed denial of services attacks.

Cyberattacks against companies like ours have increased in frequency and potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and/or detect incidents successfully in every instance. They are perpetrated by a variety of groups and persons, including state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments.

In addition, we routinely provide certain Confidential Information to third-party providers whose products and services are used in our business operations, including as part of our IT systems, such as cloud services. These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information.

In August 2021, we disclosed that our systems were subject to a criminal cyberattack that compromised certain data of millions of our current customers, former customers, and prospective customers, including, in some instances, social security numbers, names, addresses, dates of birth and driver’s license/identification numbers. With the assistance of outside cybersecurity experts, we located and closed the unauthorized access to our systems and identified current, former, and prospective customers whose information was impacted and notified them, consistent with state and federal requirements. We have incurred certain cyberattack-related expenses, including costs to remediate the attack, provide additional customer support and enhance customer protection, and expect to incur additional expense in future periods resulting from the attack. For more information, see “Cyberattack” in the Overview section of MD&A. As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation. For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 11 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.” As a result of the August 2021 cyberattack, we may incur significant costs or experience other material financial impacts, which

may not be covered by, or may exceed the coverage limits of, our cyber insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

In addition to the August 2021 cyberattack, we have experienced other unrelated immaterial incidents involving unauthorized access to certain Confidential Information. Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property.

Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third-party providers will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or systems or exploits against third-party environments, or that we or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. Our inability to protect Confidential Information or to prevent operational disruptions from future cyberattacks may have a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds

None.

Item 3. Defaults Upon Senior Securities

None.

Item 4. Mine Safety Disclosures

Not applicable.

None.

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.