On April 24, 2024, we entered into a definitive agreement with a fund operated by EQT, Fund VI, to establish a joint venture between us and Fund VI to acquire Lumos, a fiber-to-the-home platform, from EQT’s predecessor fund, EQT Infrastructure III. On April 1, 2025, we completed the joint acquisition of Lumos. Pursuant to the definitive agreement, we expect to make an additional capital contribution of approximately $500 million between 2027 and 2028 under the existing business plan. The additional capital contribution is excluded from our reported purchase commitments above. See Note 3 – Joint Ventures for additional details.

On May 24, 2024, we entered into a securities purchase agreement with UScellular, Telephone and Data Systems, Inc., and USCC Wireless Holdings, LLC, pursuant to which, among other things, we will acquire substantially all of UScellular’s wireless operations and select spectrum assets for an aggregate purchase price of approximately $4.4 billion, payable in cash and the assumption of up to $2.0 billion of debt through exchange offers to certain UScellular debtholders prior to closing. To the extent any debtholders do not participate in the Exchange Offers, their senior notes will continue as obligations of UScellular, and the cash portion of the purchase price will be correspondingly increased. Following the closing of the transaction, we will enter into a 15-year master license agreement and estimate the incremental future minimum lease payments will be $1.4 billion over 15 years post-closing. The estimated purchase price and incremental minimum lease payments are excluded from our reported purchase commitments above. See Note 2 – Business Combinations for additional details.

On July 18, 2024, we entered into a definitive agreement with KKR to establish a joint venture to acquire Metronet, a fiber-to-the-home platform. At closing, we expect to invest approximately $4.6 billion, adjusted for Metronet’s incremental pre-close debt financing, to acquire a 50% equity interest in the joint venture and all existing residential fiber customers, as well as funding of the joint venture. The estimated purchase price is excluded from our reported purchase commitments above. See Note 3 – Joint Ventures for additional details.

In connection with the regulatory proceedings and approvals of the Sprint Merger pursuant to the Business Combination Agreement with Sprint and the other parties named therein (as amended, the “Business Combination Agreement”) and the other transactions contemplated by the Business Combination Agreement, we have commitments and other obligations to various state and federal agencies and certain nongovernmental organizations, including pursuant to the Consent Decree agreed to by us, DT, Sprint, SoftBank Group Corp. (“SoftBank”) and DISH Network Corporation and entered by the U.S. District Court for the District of Columbia, and the FCC’s memorandum opinion and order approving our applications for approval of the Sprint Merger. These commitments and obligations include, among other things, extensive 5G network build-out commitments, obligations to deliver high-speed wireless services to the vast majority of Americans, including Americans residing in rural areas, and the marketing of an in-home broadband product where spectrum capacity is available. Other commitments relate to national security, pricing, service, employment and support of diversity initiatives. Many of the commitments specify time

We are involved in various lawsuits and disputes, claims, government agency investigations and enforcement actions, and other proceedings (“Litigation and Regulatory Matters”) that arise in the ordinary course of business, which include claims of patent infringement (most of which are asserted by non-practicing entities primarily seeking monetary damages), class actions, and proceedings to enforce FCC or other government agency rules and regulations. Those Litigation and Regulatory Matters are at various stages, and some of them may proceed to trial, arbitration, hearing, or other adjudication that could result in fines, penalties, or awards of monetary or injunctive relief in the coming 12 months if they are not otherwise resolved. We have established an accrual with respect to certain of these matters, where appropriate. The accruals are reflected on our condensed consolidated financial statements, but they are not considered to be, individually or in the aggregate, material. An accrual is established when we believe it is both probable that a loss has been incurred and an amount can be reasonably estimated. For other matters, where we have not determined that a loss is probable or because the amount of loss cannot be reasonably estimated, we have not recorded an accrual due to various factors typical in contested proceedings, including, but not limited to, uncertainty concerning legal theories and their resolution by courts or regulators, uncertain damage theories and demands, and a less than fully developed factual record. For Litigation and Regulatory Matters that may result in a contingent gain, we recognize such gains on our condensed consolidated financial statements when the gain is realized or realizable. We recognize legal costs expected to be incurred in connection with Litigation and Regulatory Matters as they are incurred. Except as otherwise specified below, we do not expect that the ultimate resolution of these Litigation and Regulatory Matters, individually or in the aggregate, will have a material adverse effect on our financial position, but we note that an unfavorable outcome of some or all of the specific matters identified below, or other matters that we are or may become involved in could have a material adverse impact on results of operations or cash flows for a particular period. This assessment is based on our current understanding of relevant facts and circumstances. As such, our view of these matters is subject to inherent uncertainties and may change in the future.

On February 28, 2020, T-Mobile and Sprint each received a Notice of Apparent Liability for Forfeiture and Admonishment from the FCC, which proposed a penalty for allegedly violating section 222 of the Communications Act and the FCC’s regulations governing the privacy of customer information. On April 29, 2024, the FCC issued Forfeiture Orders against T-Mobile and Sprint that largely adopted the allegations and conclusions of the Notices of Apparent Liability and imposed penalties on T-Mobile and Sprint. T-Mobile and Sprint paid those penalties under protest, and on June 27, 2024, T-Mobile and Sprint filed Petitions for Review challenging the FCC’s Forfeiture Orders in the United States Court of Appeals for the District of Columbia. We are unable to predict the potential outcome of those proceedings.

On April 1, 2020, in connection with the closing of the Sprint Merger, we assumed the contingencies and litigation matters of Sprint. Those matters include a wide variety of disputes, claims, government agency investigations and enforcement actions, and other proceedings. These matters include, among other things, certain ongoing FCC and state government agency investigations into Sprint’s Lifeline program. In September 2019, Sprint notified the FCC that it had claimed monthly subsidies for serving subscribers, even though these subscribers may not have met usage requirements under Sprint's usage policy for the Lifeline program, due to an inadvertent coding issue in the system used to identify qualifying subscriber usage that occurred in July 2017 while the system was being updated. Sprint has made a number of payments to reimburse the federal government and certain states for excess subsidy payments.

We note that, pursuant to Amendment No. 2, dated as of February 20, 2020, to the Business Combination Agreement, dated as of April 29, 2018, by and among the Company, Sprint and the other parties named therein, SoftBank agreed to indemnify us against certain specified matters and losses, including those relating to the Lifeline matters described above. Resolution of these matters could require us to make additional reimbursements and pay additional fines and penalties, which we do not expect to have a significant impact on our financial results. We expect that any additional liabilities related to these indemnified matters would be indemnified and reimbursed by SoftBank.

On June 1, 2021, a putative shareholder class action and derivative lawsuit was filed in the Delaware Court of Chancery, Dinkevich v. Deutsche Telekom AG, et al., Case No. C.A. No. 2021-0479, against DT, SoftBank and certain of our current and former officers and directors, asserting breach of fiduciary duty claims relating to the repricing amendment to the Business Combination Agreement and to SoftBank’s monetization of its T-Mobile shares. We are also named as a nominal defendant in the case. We are unable to predict the potential outcome of these claims.

On August 12, 2021, we became aware of a cybersecurity issue involving unauthorized access to T-Mobile’s systems (the “August 2021 cyberattack”). We immediately began an investigation and engaged cybersecurity experts to assist with the assessment of the incident and to help determine what data was impacted. Our investigation uncovered that the perpetrator had illegally gained access to certain areas of our systems on or about March 18, 2021, but only gained access to and took data of current, former, and prospective customers beginning on or about August 3, 2021. With the assistance of our outside cybersecurity experts, we located and closed the unauthorized access to our systems and identified current, former and prospective customers whose information was impacted and notified them, consistent with state and federal requirements. We also undertook a number of other measures to demonstrate our continued support and commitment to data privacy and protection. We also coordinated with law enforcement. Our forensic investigation is complete, and we believe we have a full view of the data compromised.

As a result of the August 2021 cyberattack, we have become subject to numerous lawsuits, including mass arbitration claims and multiple class action lawsuits that have been filed in numerous jurisdictions seeking, among other things, unspecified monetary damages, costs and attorneys’ fees arising out of the August 2021 cyberattack. In December 2021, the Judicial Panel on Multidistrict Litigation consolidated the federal class action lawsuits in the U.S. District Court for the Western District of Missouri under the caption In re: T-Mobile Customer Data Security Breach Litigation, Case No. 21-md-3019-BCW. On July 22, 2022, we entered into an agreement to settle the lawsuit. On June 29, 2023, the Court issued an order granting final approval of the settlement. All appeals have been resolved, and the settlement is now final. Under the terms of the settlement, we have paid an aggregate of $350 million to fund claims submitted by class members, the legal fees of plaintiffs’ counsel and the costs of administering the settlement. As required under the terms of the settlement, we have spent an aggregate of $150 million for data security and related technology in 2022 and 2023. The settlement provides a full release of all claims arising out of the August 2021 cyberattack by class members who did not opt out, against all defendants, including us, our subsidiaries and affiliates, and our directors and officers. The settlement contains no admission of liability, wrongdoing or responsibility by any of the defendants.

In addition, in September 2022, a purported Company shareholder filed a derivative action in the Delaware Court of Chancery under the caption Harper v. Sievert, et al., Case No. 2022-0819-SG, against our current directors and certain of our former directors, alleging claims for breach of fiduciary duty relating to the Company’s cybersecurity practices. We are also named as a nominal defendant in the lawsuit. On May 31, 2024, the court issued an opinion dismissing the plaintiff’s complaint in its entirety. The plaintiff appealed that decision, and on February 17, 2025, the Delaware Supreme Court affirmed the Court of Chancery’s decision dismissing the complaint. We are unable at this time to predict whether we may be subject to further private litigation relating to the August 2021 cyberattack or the Company’s cybersecurity practices.

We have also received inquiries and contested legal proceedings from various government agencies, law enforcement and other governmental authorities related to the August 2021 cyberattack, which could result in substantial fines or penalties. We reached an agreement with the FCC, which was announced on September 30, 2024, to resolve one of those inquiries. We will continue to cooperate fully with the other agencies and regulators inquiring about the matter with an aim to resolve all of these matters. While we hope to resolve them in the near term, we cannot predict the timing or outcome of any of these matters or whether we may be subject to further regulatory inquiries, investigations, or enforcement actions.

In light of the inherent uncertainties involved in such matters, and based on the information currently available to us, in addition to the previously recorded pre-tax charge of approximately $400 million noted above, we believe it is reasonably possible that we could incur additional losses associated with these proceedings and inquiries, and we will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future actions, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition, cash flows and operating results.

On June 17, 2022, plaintiffs filed a putative antitrust class action complaint in the Northern District of Illinois, Dale, et al. v. Deutsche Telekom AG, et al., Case No. 1:22-cv-03189, against DT, T-Mobile, and SoftBank, alleging that the Sprint Merger violated the antitrust laws and harmed competition in the U.S. retail cell service market. Plaintiffs seek injunctive relief and trebled monetary damages on behalf of a purported class of AT&T and Verizon customers whom plaintiffs allege paid artificially inflated prices due to the Sprint Merger. We are vigorously defending this lawsuit, but we are unable to predict the potential outcome.

On January 5, 2023, we identified that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization. Based on our investigation, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information, such as the number of lines on the account and plan features. The result from our investigation indicates that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. We believe that the bad actor first retrieved data through the impacted API starting on or around November 25, 2022. We have notified individuals whose information was impacted consistent with state and federal requirements.

On February 25, 2025, a purported Company shareholder filed a putative class action and derivative lawsuit in the Delaware Court of Chancery under the caption Palkon v. Deutsche Telekom AG, et al., Case No. 2025-0211-PAF, against four DT entities, our current directors, and certain of our former directors, asserting breach of fiduciary duty and unjust enrichment claims relating to our 2022 Stock Repurchase Program and our 2023-2024 Stockholder Return Program. We are also named as a nominal defendant in the lawsuit. We are unable to predict the potential outcome of these claims.