T-Mobile US 10-Q 2023-06-30

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

☒ QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended June 30, 2023

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number: 1-33409

T-MOBILE US, INC.

(Exact name of registrant as specified in its charter)

12920 SE 38th Street

Bellevue, Washington

(Address of principal executive offices)

98006-1350

(Zip Code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

Indicate the number of shares outstanding of each of the issuer’s classes of common stock, as of the latest practicable date.

T-Mobile US, Inc.

Form 10-Q

For the Quarter Ended June 30, 2023

Table of Contents

Index for Notes to the Condensed Consolidated Financial Statements

PART I. FINANCIAL INFORMATION

T-Mobile US, Inc.

Condensed Consolidated Balance Sheets

(Unaudited)

The accompanying notes are an integral part of these condensed consolidated financial statements.

Index for Notes to the Condensed Consolidated Financial Statements

T-Mobile US, Inc.

Condensed Consolidated Statements of Comprehensive Income (Loss)

(Unaudited)

Showing the first 8K of 197K characters. Open the full section

Cautionary Statement Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q (“Form 10-Q”) of T-Mobile US, Inc. (“T-Mobile,” “we,” “our,” “us” or the “Company”) includes forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements, other than statements of historical fact, including information concerning our future results of operations, are forward-looking statements. These forward-looking statements are generally identified by the words “anticipate,” “believe,” “estimate,” “expect,” “intend,” “may,” “could” or similar expressions. Forward-looking statements are based on current expectations and assumptions, which are subject to risks and uncertainties that may cause actual results to differ materially from the forward-looking statements. The following important factors, along with the Risk Factors included in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2022, and Part II, Item 1A of this Form 10-Q, could affect future results and cause those results to differ materially from those expressed in the forward-looking statements:

• competition, industry consolidation and changes in the market for wireless communications services and other forms of connectivity;

• criminal cyberattacks, disruption, data loss or other security breaches;

• our inability to take advantage of technological developments on a timely basis;

• our inability to retain or motivate key personnel, hire qualified personnel or maintain our corporate culture;

• system failures and business disruptions, allowing for unauthorized use of or interference with our network and other systems;

• the scarcity and cost of additional wireless spectrum, and regulations relating to spectrum use;

• the difficulties in maintaining multiple billing systems following our merger (the “Merger”) with Sprint Corporation (“Sprint”) pursuant to a Business Combination Agreement with Sprint and the other parties named therein (as amended, the “Business Combination Agreement”) and any unanticipated difficulties, disruption, or significant delays in our long-term strategy to convert Sprint’s legacy customers onto T-Mobile’s billing platforms;

• the impacts of the actions we have taken and conditions we have agreed to in connection with the regulatory proceedings and approvals of the Merger and the other transactions contemplated by the Business Combination Agreement (collectively, the “Transactions”), including the acquisition by DISH Network Corporation (“DISH”) of the prepaid wireless business operated under the Boost Mobile and Sprint prepaid brands (excluding the Assurance brand Lifeline customers and the prepaid wireless customers of Shenandoah Personal Communications Company LLC (“Shentel”) and Swiftel Communications, Inc.), including customer accounts, inventory, contracts, intellectual property and certain other specified assets, and the assumption of certain related liabilities (collectively, the “Prepaid Transaction”), the complaint and proposed final judgment agreed to by us, Deutsche Telekom AG (“DT”), Sprint, SoftBank Group Corp. (“SoftBank”) and DISH with the U.S. District Court for the District of Columbia, which was approved by the Court on April 1, 2020, the proposed commitments filed with the Secretary of the Federal Communications Commission (“FCC”), which we announced on May 20, 2019, certain national security commitments and undertakings, and any other commitments or undertakings entered into, including, but not limited to, those we have made to certain states and nongovernmental organizations (collectively, the “Government Commitments”), and the challenges in satisfying the Government Commitments in the required time frames and the significant cumulative costs incurred in tracking and monitoring compliance over multiple years;

• adverse economic, political or market conditions in the U.S. and international markets, including changes resulting from increases in inflation or interest rates, supply chain disruptions and impacts of current geopolitical instability caused by the war in Ukraine;

• our inability to manage the ongoing commercial and transition services arrangements entered into in connection with the Prepaid Transaction, and known or unknown liabilities arising in connection therewith;

• the timing and effects of any future acquisition, divestiture, investment, or merger involving us;

• any disruption or failure of our third parties (including key suppliers) to provide products or services for the operation of our business;

• our inability to fully realize the synergy benefits from the Transactions in the expected time frame;

• our substantial level of indebtedness and our inability to service our debt obligations in accordance with their terms or to comply with the restrictive covenants contained therein;

• changes in the credit market conditions, credit rating downgrades or an inability to access debt markets;

• restrictive covenants including the agreements governing our indebtedness and other financings;

• the risk of future material weaknesses we may identify or any other failure by us to maintain effective internal controls, and the resulting significant costs and reputational damage;

• any changes in regulations or in the regulatory framework under which we operate;

• laws and regulations relating to the handling of privacy and data protection;

• unfavorable outcomes of and increased costs from existing or future regulatory or legal proceedings;

• our offering of regulated financial services products and exposure to a wide variety of state and federal regulations;

• new or amended tax laws or regulations or administrative interpretations and judicial decisions affecting the scope or application of tax laws or regulations;

• our wireless licenses, including those controlled through leasing agreements, are subject to renewal and may be revoked;

• our exclusive forum provision as provided in our Fifth Amended and Restated Certificate of Incorporation (the “Certificate of Incorporation”);

• interests of DT, our controlling stockholder, which may differ from the interests of other stockholders;

• future sales of our common stock by DT and SoftBank and our inability to attract additional equity financing outside the United States due to foreign ownership limitations by the FCC; and

• our 2022 Stock Repurchase Program (as defined in Note 10 – Repurchases of Common Stock of the Notes to the Condensed Consolidated Financial Statements) may not be fully consummated, and our share repurchase program may not enhance long-term stockholder value.

Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements. We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law.

Investors and others should note that we announce material information to our investors using our investor relations website (https://investor.t-mobile.com), newsroom website (https://t-mobile.com/news), press releases, SEC filings and public conference calls and webcasts. We intend to also use certain social media accounts as means of disclosing information about us and our services and for complying with our disclosure obligations under Regulation FD (the @TMobileIR Twitter account (https://twitter.com/TMobileIR), the @MikeSievert Twitter account (https://twitter.com/MikeSievert), which Mr. Sievert also uses as a means for personal communications and observations, and the @TMobileCFO Twitter Account (https://twitter.com/tmobilecfo) and our Chief Financial Officer’s LinkedIn account (https://www.linkedin.com/in/peter-osvaldik-3887394), both of which Mr. Osvaldik also uses as a means for personal communication and observations). The information we post through these social media channels may be

Showing the first 8K of 197K characters. Open the full section

There have been no material changes to the interest rate risk as previously disclosed in Part II, Item 7A of our Annual Report on Form 10-K for the year ended December 31, 2022.

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures designed to ensure information required to be disclosed in our periodic reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Our disclosure controls include the use of a Disclosure Committee which is comprised of representatives from our Accounting, Legal, Treasury, Technology, Risk Management, Government Affairs and Investor Relations functions and are designed to ensure that information required to be disclosed in the reports we file or submit under the Exchange Act is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosure.

Under the supervision and with the participation of our management, including our Chief Executive Officer and our Chief Financial Officer, we carried out an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act. Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective, as of the end of the period covered by this Form 10-Q.

The certifications required by Section 302 of the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) are filed as Exhibits 31.1 and 31.2 to this Form 10-Q.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act, during our most recently completed fiscal quarter that materially affected or are reasonably likely to materially affect our internal control over financial reporting.

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

For more information regarding the legal proceedings in which we are involved, see Note 13 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements.

Other than the updated risk factor below, there have been no material changes in our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2022.

We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”). Additionally, to offer services to our customers and operate our business, we utilize a number of products and services, such as IT networks and systems, including those we own and operate as well as others provided by third-party providers, such as cloud services (collectively, “Systems”).

We are subject to persistent cyberattacks and threats to our business from a variety of bad actors, many of whom attempt to gain unauthorized access to and compromise Confidential Information and Systems. In some cases, the bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information. In other cases, these bad actors may obtain unauthorized access to Confidential Information utilizing credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means. Other bad actors aim to cause serious operational disruptions to our business and Systems through ransomware or distributed denial of services attacks.

Cyberattacks against companies like ours have increased in frequency and potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and/or detect incidents successfully in every instance. They are perpetrated by a variety of groups and persons, including state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments.

In addition, we routinely rely upon third-party providers whose products and services are used in our business. These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information.

In August 2021, we disclosed that our systems were subject to a criminal cyberattack that compromised certain data of millions of our current customers, former customers, and prospective customers, including, in some instances, social security numbers, names, addresses, dates of birth and driver’s license/identification numbers. With the assistance of outside cybersecurity experts, we located and closed the unauthorized access to our systems and identified current, former, and prospective customers whose information was impacted and notified them, consistent with state and federal requirements. We have incurred certain cyberattack-related expenses, including costs to remediate the attack, provide additional customer support and enhance customer protection, and expect to incur additional expense in future periods resulting from the attack. For more information, see “Recent Cyberattacks” in the Overview section of our Management’s Discussion and Analysis of Financial Condition and Results of Operations. As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation. For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 13 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.

In January 2023, we disclosed that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization. Based on our investigation, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features. The result from our investigation indicates that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. We believe that the bad actor first retrieved data through the impacted API starting on or around November 25, 2022. We have notified individuals whose information was impacted consistent with state and federal requirements.

As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage

limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

In addition to the recent cyberattacks, we have experienced other unrelated immaterial incidents involving unauthorized access to certain Confidential Information. Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property. Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers.

Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third-party providers, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. We also expect that threat actors will continue to gain sophistication including in the use of tools and techniques (such as artificial intelligence) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more challenging for us to identify, investigate and recover from future cyberattacks in a timely and effective manner. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Unfavorable outcomes of legal proceedings may adversely affect our business, reputation, financial condition, cash flows and operating results.

We and our affiliates are involved in various disputes, governmental and/or regulatory inspections, investigations and proceedings, mass arbitrations and litigation matters. Such legal proceedings can be complex, costly, and highly disruptive to our business operations by diverting the attention and energy of management and other key personnel.

In connection with the Transactions, we became subject to a number of legal proceedings, including a putative shareholder class action and derivative lawsuit and a putative antitrust class action. For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 13 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. It is possible that stockholders of T-Mobile and/or Sprint may file additional putative class action lawsuits or shareholder derivative actions against the Company and the legacy T-Mobile board of directors and/or the legacy Sprint board of directors. Among other remedies, these stockholders could seek damages. The outcome of any litigation is uncertain, and any such potential lawsuits could result in substantial costs and may be costly and distracting to management.

Additionally, on April 1, 2020, in connection with the closing of the Merger, we assumed the contingencies and litigation matters of Sprint. Those matters include a wide variety of disputes, claims, government agency investigations and enforcement actions and other proceedings. Unfavorable resolution of these matters could require us to make additional reimbursements and pay additional fines and penalties.

On February 28, 2020, we received a Notice of Apparent Liability for Forfeiture and Admonishment from the FCC, which proposed a penalty against us for allegedly violating Section 222 of the Communications Act and the FCC’s regulations governing the privacy of customer information. We recorded an accrual for an estimated payment amount as of March 31, 2020, which is included in Accounts payable and accrued liabilities on our Consolidated Balance Sheets.

As a result of the August 2021 cyberattack, we are subject to numerous lawsuits, including consolidated class action lawsuits seeking unspecified monetary damages, mass consumer arbitrations, a shareholder derivative lawsuit and inquiries by various government agencies, law enforcement and other governmental authorities, and we may be subject to further regulatory inquiries and private litigation. We are cooperating fully with regulators and vigorously defending against the class actions and other lawsuits. On July 22, 2022, we entered into an agreement to settle the consolidated class action lawsuit. On June 29, 2023,

the Court issued an order granting final approval of the settlement, which is subject to potential appeals. Under the terms of the settlement, we would pay an aggregate of $350 million to fund claims submitted by class members, the legal fees of plaintiffs’ counsel and the costs of administering the settlement. We would also commit to an aggregate incremental spend of $150 million for data security and related technology in 2022 and 2023. In connection with the class action settlement and other settlements of separate consumer claims that have been previously completed or are currently pending, we recorded a total pre-tax charge of approximately $400 million during the three months ended June 30, 2022. In light of the inherent uncertainties involved in such matters and based on the information currently available to us, we believe it is reasonably possible that we could incur additional losses associated with these proceedings and inquiries, and we will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. In addition, in connection with the January 2023 cyberattack, we have received notices of consumer class actions and regulatory inquires, to which we will continue to respond in due course. Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries related to the August 2021 cyberattack and the January 2023 cyberattack, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be significant and have a material adverse impact on our business, reputation, financial condition, cash flows and operating results.

We, along with equipment manufacturers and other carriers, are subject to current and potential future lawsuits alleging adverse health effects arising from the use of wireless handsets or from wireless transmission equipment such as cell towers. In addition, the FCC has from time to time gathered data regarding wireless device emissions, and its assessment of the risks associated with using wireless devices may evolve based on its findings. Any of these allegations or changes in risk assessments could result in customers purchasing fewer devices and wireless services, could result in significant legal and regulatory liability, and could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

The assessment of the outcome of legal proceedings, including our potential liability, if any, is a highly subjective process that requires judgments about future events that are not within our control. The amounts ultimately received or paid upon settlement or pursuant to final judgment, order or decree may differ materially from amounts accrued in our financial statements. In addition, litigation or similar proceedings could impose restraints on our current or future manner of doing business. Such potential outcomes including judgments, awards, settlements or orders could have a material adverse effect on our business, reputation, financial condition, cash flows and operating results.

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds

Issuer Purchases of Equity Securities

The table below provides information regarding our share repurchases during the three months ended June 30, 2023:

(1) On September 8, 2022, our Board of Directors authorized our 2022 Stock Repurchase Program for up to $14.0 billion of our common stock through September 30, 2023. The amounts presented represent the remaining shares authorized for purchase under the 2022 Stock Repurchase Program as of the end of the period.

On May 3, 2023, the SEC adopted amendments to modernize share repurchase disclosure requirements, including requiring issuers to disclose daily share repurchase activity in an exhibit to their Form 10-Q and Form 10-K. We will be required to comply with the amendments beginning with our first filing that covers the first full fiscal quarter that begins on October 1, 2023. We plan to apply the applicable amendments, including the discontinuation of the monthly share repurchase activity in this Item and replacing with daily share repurchase activity as an exhibit to our Form 10-Qs and Form 10-Ks, beginning in our Form 10-K for the year ending December 31, 2023.

See Note 10 - Repurchases of Common Stock of the Notes to the Condensed Consolidated Financial Statements for more information about our 2022 Stock Repurchase Program.

Item 3. Defaults Upon Senior Securities

None.

Item 4. Mine Safety Disclosures

Not applicable.

During the quarter ended June 30, 2023, none of the Company’s directors or officers adopted, modified, or terminated any “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement,” as each term is defined in Item 408 of Regulation S-K.

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.