T-Mobile US 10-Q 2023-03-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

☒ QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended March 31, 2023

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number: 1-33409

T-MOBILE US, INC.

(Exact name of registrant as specified in its charter)

12920 SE 38th Street

Bellevue, Washington

(Address of principal executive offices)

98006-1350

(Zip Code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

Indicate the number of shares outstanding of each of the issuer’s classes of common stock, as of the latest practicable date.

T-Mobile US, Inc.

Form 10-Q

For the Quarter Ended March 31, 2023

Table of Contents

Index for Notes to the Condensed Consolidated Financial Statements

PART I. FINANCIAL INFORMATION

T-Mobile US, Inc.

Condensed Consolidated Balance Sheets

(Unaudited)

The accompanying notes are an integral part of these condensed consolidated financial statements.

Index for Notes to the Condensed Consolidated Financial Statements

T-Mobile US, Inc.

Condensed Consolidated Statements of Comprehensive Income

(Unaudited)

Showing the first 8K of 167K characters. Open the full section

Cautionary Statement Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q (“Form 10-Q”) of T-Mobile US, Inc. (“T-Mobile,” “we,” “our,” “us” or the “Company”) includes forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements, other than statements of historical fact, including information concerning our future results of operations, are forward-looking statements. These forward-looking statements are generally identified by the words “anticipate,” “believe,” “estimate,” “expect,” “intend,” “may,” “could” or similar expressions. Forward-looking statements are based on current expectations and assumptions, which are subject to risks and uncertainties that may cause actual results to differ materially from the forward-looking statements. The following important factors, along with the Risk Factors included in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2022, and Part II, Item 1A of this Form 10-Q, could affect future results and cause those results to differ materially from those expressed in the forward-looking statements:

• competition, industry consolidation and changes in the market for wireless communications services and other forms of connectivity;

• criminal cyberattacks, disruption, data loss or other security breaches;

• our inability to take advantage of technological developments on a timely basis;

• our inability to retain or motivate key personnel, hire qualified personnel or maintain our corporate culture;

• system failures and business disruptions, allowing for unauthorized use of or interference with our network and other systems;

• the scarcity and cost of additional wireless spectrum, and regulations relating to spectrum use;

• the difficulties in maintaining multiple billing systems following our merger (the “Merger”) with Sprint Corporation (“Sprint”) pursuant to a Business Combination Agreement with Sprint and the other parties named therein (as amended, the “Business Combination Agreement”) and any unanticipated difficulties, disruption, or significant delays in our long-term strategy to convert Sprint’s legacy customers onto T-Mobile’s billing platforms;

• the impacts of the actions we have taken and conditions we have agreed to in connection with the regulatory proceedings and approvals of the Merger and the other transactions contemplated by the Business Combination Agreement (collectively, the “Transactions”), including the acquisition by DISH Network Corporation (“DISH”) of the prepaid wireless business operated under the Boost Mobile and Sprint prepaid brands (excluding the Assurance brand Lifeline customers and the prepaid wireless customers of Shenandoah Personal Communications Company LLC (“Shentel”) and Swiftel Communications, Inc.), including customer accounts, inventory, contracts, intellectual property and certain other specified assets, and the assumption of certain related liabilities (collectively, the “Prepaid Transaction”), the complaint and proposed final judgment agreed to by us, Deutsche Telekom AG (“DT”), Sprint, SoftBank Group Corp. (“SoftBank”) and DISH with the U.S. District Court for the District of Columbia, which was approved by the Court on April 1, 2020, the proposed commitments filed with the Secretary of the Federal Communications Commission (“FCC”), which we announced on May 20, 2019, certain national security commitments and undertakings, and any other commitments or undertakings entered into, including, but not limited to, those we have made to certain states and nongovernmental organizations (collectively, the “Government Commitments”), and the challenges in satisfying the Government Commitments in the required time frames and the significant cumulative costs incurred in tracking and monitoring compliance over multiple years;

• adverse economic, political or market conditions in the U.S. and international markets, including changes resulting from increases in inflation or interest rates, supply chain disruptions and impacts of current geopolitical instability caused by the war in Ukraine;

• our inability to manage the ongoing commercial and transition services arrangements entered into in connection with the Prepaid Transaction, and known or unknown liabilities arising in connection therewith;

• the timing and effects of any future acquisition, divestiture, investment, or merger involving us;

• any disruption or failure of our third parties (including key suppliers) to provide products or services for the operation of our business;

• our inability to fully realize the synergy benefits from the Transactions in the expected time frame;

• our substantial level of indebtedness and our inability to service our debt obligations in accordance with their terms or to comply with the restrictive covenants contained therein;

• changes in the credit market conditions, credit rating downgrades or an inability to access debt markets;

• restrictive covenants including the agreements governing our indebtedness and other financings;

• the risk of future material weaknesses we may identify or any other failure by us to maintain effective internal controls, and the resulting significant costs and reputational damage;

• any changes in regulations or in the regulatory framework under which we operate;

• laws and regulations relating to the handling of privacy and data protection;

• unfavorable outcomes of and increased costs from existing or future regulatory or legal proceedings;

• our offering of regulated financial services products and exposure to a wide variety of state and federal regulations;

• new or amended tax laws or regulations or administrative interpretations and judicial decisions affecting the scope or application of tax laws or regulations;

• our wireless licenses, including those controlled through leasing agreements, are subject to renewal and may be revoked;

• our exclusive forum provision as provided in our Fifth Amended and Restated Certificate of Incorporation (the “Certificate of Incorporation”);

• interests of DT, our controlling stockholder, that may differ from the interests of other stockholders;

• future sales of our common stock by DT and SoftBank and our inability to attract additional equity financing outside the United States due to foreign ownership limitations by the FCC; and

• our 2022 Stock Repurchase Program (as defined in Note 10 – Repurchases of Common Stock of the Notes to the Condensed Consolidated Financial Statements) may not be fully consummated, and our share repurchase program may not enhance long-term stockholder value.

Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements. We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law.

Investors and others should note that we announce material information to our investors using our investor relations website (https://investor.t-mobile.com), newsroom website (https://t-mobile.com/news), press releases, SEC filings and public conference calls and webcasts. We intend to also use certain social media accounts as means of disclosing information about us and our services and for complying with our disclosure obligations under Regulation FD (the @TMobileIR Twitter account (https://twitter.com/TMobileIR), the @MikeSievert Twitter account (https://twitter.com/MikeSievert), which Mr. Sievert also uses as a means for personal communications and observations, and the @TMobileCFO Twitter Account (https://twitter.com/tmobilecfo) and our Chief Financial Officer’s LinkedIn account (https://www.linkedin.com/in/peter-osvaldik-3887394), both of which Mr. Osvaldik also uses as a means for personal communication and observations). The information we post through these social media channels may be

Showing the first 8K of 181K characters. Open the full section

There have been no material changes to the interest rate risk as previously disclosed in Part II, Item 7A of our Annual Report on Form 10-K for the year ended December 31, 2022.

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures designed to ensure information required to be disclosed in our periodic reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Our disclosure controls include the use of a Disclosure Committee which is comprised of representatives from our Accounting, Legal, Treasury, Technology, Risk Management, Government Affairs and Investor Relations functions and are designed to ensure that information required to be disclosed in the reports we file or submit under the Exchange Act is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosure.

Under the supervision and with the participation of our management, including our Chief Executive Officer and our Chief Financial Officer, we carried out an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act. Based upon that evaluation, our Chief

Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective, as of the end of the period covered by this Form 10-Q.

The certifications required by Section 302 of the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) are filed as Exhibits 31.1 and 31.2, respectively, to this Form 10-Q.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act, during our most recently completed fiscal quarter that materially affected or are reasonably likely to materially affect our internal control over financial reporting.

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

For more information regarding the legal proceedings in which we are involved, see Note 13 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements.

Other than the updated risk factor below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2022.

We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”). Additionally, to offer services to our customers and operate our business, we utilize a number of networks and systems, including those we own and operate as well as others provided by third-party providers, such as cloud services (collectively, “Systems”).

We are subject to persistent cyberattacks and threats to our business from a variety of bad actors, many of whom attempt to gain unauthorized access to and compromise Confidential Information and Systems. In some cases, the bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information. In other cases, these bad actors may obtain unauthorized access to Confidential Information utilizing credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means. Other bad actors aim to cause serious operational disruptions to our business through ransomware or distributed denial of services attacks.

Cyberattacks against companies like ours have increased in frequency and potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and/or detect incidents successfully in every instance. They are perpetrated by a variety of groups and persons, including state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments.

In addition, we routinely rely upon third-party providers whose products and services are used in our business. These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information.

In August 2021, we disclosed that our systems were subject to a criminal cyberattack that compromised certain data of millions of our current customers, former customers, and prospective customers, including, in some instances, social security numbers, names, addresses, dates of birth and driver’s license/identification numbers. With the assistance of outside cybersecurity experts, we located and closed the unauthorized access to our systems and identified current, former, and prospective customers whose information was impacted and notified them, consistent with state and federal requirements. We have incurred certain

cyberattack-related expenses, including costs to remediate the attack, provide additional customer support and enhance customer protection, and expect to incur additional expense in future periods resulting from the attack. For more information, see “Recent Cyberattacks” in the Overview section of our Management’s Discussion and Analysis of Financial Condition and Results of Operations. As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation. For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 13 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.

In January 2023, we disclosed that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization. Based on our investigation, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features. The result from our investigation indicates that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. We believe that the bad actor first retrieved data through the impacted API starting on or around November 25, 2022. We have notified individuals whose information was impacted consistent with state and federal requirements.

As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

In addition to the recent cyberattacks, we have experienced other unrelated immaterial incidents involving unauthorized access to certain Confidential Information. Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property. Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers.

Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third-party providers, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds

Issuer Purchases of Equity Securities

The table below provides information regarding our share repurchases during the three months ended March 31, 2023:

(1) On September 8, 2022, our Board of Directors authorized our 2022 Stock Repurchase Program for up to $14.0 billion of our common stock through September 30, 2023. The amounts presented represent the remaining shares authorized for purchase under the 2022 Stock Repurchase Program as of the end of the period.

See Note 10 - Repurchases of Common Stock of the Notes to the Condensed Consolidated Financial Statements for more information about our 2022 Stock Repurchase Program.

Item 3. Defaults Upon Senior Securities

None.

Item 4. Mine Safety Disclosures

Not applicable.

None.

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.