On April 24, 2024, we entered into a definitive agreement with a fund operated by EQT, Fund VI, to establish a joint venture between us and Fund VI to acquire Lumos, a fiber-to-the-home platform, from EQT’s predecessor fund, EQT Infrastructure III. On April 1, 2025, we completed the joint acquisition of Lumos. Pursuant to the definitive agreement, we expect to make an additional capital contribution of approximately $500 million between 2027 and 2028 under the existing business plan. The additional capital contribution is excluded from our reported purchase commitments above. See Note 3 – Joint Ventures for additional details.

We lease spectrum from various parties. These leases include service obligations to the lessors. Certain spectrum leases provide for minimum lease payments, additional charges, renewal options and escalation clauses. Leased spectrum agreements have varying expiration terms that generally extend through 2050. We expect that all renewal periods in our spectrum leases will be exercised by us. Certain spectrum leases also include purchase options and right-of-first refusal clauses in which we are provided the opportunity to exercise our purchase option if the lessor receives a purchase offer from a third party. The purchase of the leased spectrum is at our option and, therefore, the option price is not included in the commitments below.

On September 12, 2023, we entered into a License Purchase Agreement with Comcast pursuant to which we will acquire spectrum in the 600 MHz band from Comcast in exchange for total cash consideration of between $1.2 billion and $3.3 billion, subject to an application for FCC approval. The licenses are subject to an exclusive leasing arrangement between us and Comcast entered into contemporaneously with the License Purchase Agreement. On January 13, 2025, we and Comcast entered into an amendment to the License Purchase Agreement pursuant to which we will acquire additional spectrum. Subsequent to the amendment, the total cash consideration for the transaction is between $1.2 billion and $3.4 billion. The agreement remains subject to an application for FCC approval and is excluded from our reported purchase commitments above. See Note 7 – Goodwill, Spectrum License Transactions and Other Intangible Assets for additional details.

In connection with the regulatory proceedings and approvals of the Sprint Merger pursuant to the Business Combination Agreement with Sprint and the other parties named therein (as amended, the “Business Combination Agreement”) and the other transactions contemplated by the Business Combination Agreement, we have commitments and other obligations to various state and federal agencies and certain nongovernmental organizations, including pursuant to the Consent Decree agreed to by us, DT, Sprint, SoftBank and DISH and entered by the U.S. District Court for the District of Columbia, and the FCC’s memorandum opinion and order approving our applications for approval of the Sprint Merger. These commitments and obligations include, among other things, extensive 5G network build-out commitments, obligations to deliver high-speed wireless services to the vast majority of Americans, including Americans residing in rural areas, the marketing of an in-home broadband product where spectrum capacity is available and national security commitments. Many of the commitments specify time frames for compliance and reporting. Failure to fulfill our obligations and commitments in a timely manner could result in substantial fines, penalties, or other legal and administrative actions.

We are involved in various lawsuits and disputes, claims, government agency investigations and enforcement actions, and other proceedings (“Litigation and Regulatory Matters”) that arise in the ordinary course of business, which include claims of patent infringement (most of which are asserted by non-practicing entities primarily seeking monetary damages), class actions, and proceedings to enforce FCC or other government agency rules and regulations. Those Litigation and Regulatory Matters are at various stages, and some of them may proceed to trial, arbitration, hearing, or other adjudication that could result in fines, penalties, or awards of monetary or injunctive relief in the coming 12 months if they are not otherwise resolved. We have established an accrual with respect to certain of these matters, where appropriate. The accruals are reflected on our consolidated financial statements, but they are not considered to be, individually or in the aggregate, material. An accrual is established when we believe it is both probable that a loss has been incurred and an amount can be reasonably estimated. For other matters, where we have not determined that a loss is probable or because the amount of loss cannot be reasonably estimated, we have not recorded an accrual due to various factors typical in contested proceedings, including, but not limited to, uncertainty concerning legal theories and their resolution by courts or regulators, uncertain damage theories and demands, and a less than fully developed factual record. For Litigation and Regulatory Matters that may result in a contingent gain, we recognize such gains on our consolidated financial statements when the gain is realized or realizable. We recognize legal costs expected to be incurred in connection with Litigation and Regulatory Matters as they are incurred. Except as otherwise specified below, we do not expect that the ultimate resolution of these Litigation and Regulatory Matters, individually or in the aggregate, will have a

material adverse effect on our financial position, but we note that an unfavorable outcome of some or all of the specific matters identified below, or other matters that we are or may become involved in could have a material adverse impact on results of operations or cash flows for a particular period. This assessment is based on our current understanding of relevant facts and circumstances. As such, our view of these matters is subject to inherent uncertainties and may change in the future.

On February 28, 2020, T-Mobile and Sprint each received a Notice of Apparent Liability for Forfeiture and Admonishment from the FCC, which proposed a penalty for allegedly violating section 222 of the Communications Act and the FCC’s regulations governing the privacy of customer information. On April 29, 2024, the FCC issued Forfeiture Orders against T-Mobile and Sprint that largely adopted the allegations and conclusions of the Notices of Apparent Liability and imposed penalties on T-Mobile and Sprint. T-Mobile and Sprint paid those penalties under protest, and on June 27, 2024, T-Mobile and Sprint filed Petitions for Review challenging the FCC’s Forfeiture Orders in the United States Court of Appeals for the District of Columbia. On August 15, 2025, a panel of three judges denied the petitions for review. On January 23, 2026, the Court of Appeals denied T-Mobile’s petitions for rehearing and rehearing en banc. T-Mobile intends to file a petition for a writ of certiorari with the United States Supreme Court. We are unable to predict the potential outcome of those proceedings.

On June 1, 2021, a putative shareholder class action and derivative lawsuit was filed in the Delaware Court of Chancery, Dinkevich v. Deutsche Telekom AG, et al., Case No. C.A. No. 2021-0479, against DT, SoftBank and certain of our current and former officers and directors, asserting breach of fiduciary duty claims relating to the repricing amendment to the Business Combination Agreement and to SoftBank’s monetization of its T-Mobile shares. We are also named as a nominal defendant in the case. We are unable to predict the potential outcome of these claims.

On August 12, 2021, we became aware of a cybersecurity issue involving unauthorized access to T-Mobile’s systems (the “August 2021 cyberattack”). Our investigation uncovered that the perpetrator had illegally gained access to certain areas of our systems on or about March 18, 2021, but only gained access to and took data of current, former, and prospective customers beginning on or about August 3, 2021.

As a result of the August 2021 cyberattack, we have become subject to numerous lawsuits, including mass arbitration claims and multiple class action lawsuits that have been filed in numerous jurisdictions seeking, among other things, unspecified monetary damages, costs and attorneys’ fees arising out of the August 2021 cyberattack. In December 2021, the Judicial Panel on Multidistrict Litigation consolidated the federal class action lawsuits in the U.S. District Court for the Western District of Missouri under the caption In re: T-Mobile Customer Data Security Breach Litigation, Case No. 21-md-3019-BCW. On July 22, 2022, we entered into an agreement to settle the lawsuit. On June 29, 2023, the Court issued an order granting final approval of the settlement. All appeals have been resolved, and the settlement is now final. Under the terms of the settlement, we have paid an aggregate of $350 million to fund claims submitted by class members, the legal fees of plaintiffs’ counsel and the costs of administering the settlement. As required under the terms of the settlement, we have spent an aggregate of $150 million for data security and related technology in 2022 and 2023. The settlement provides a full release of all claims arising out of the August 2021 cyberattack by class members who did not opt out, against all defendants, including us, our subsidiaries and affiliates, and our directors and officers. The settlement contains no admission of liability, wrongdoing or responsibility by any of the defendants.

We anticipate that this settlement of the class action, along with other settlements of separate consumer claims that have been previously completed or are currently pending, will resolve substantially all of the claims brought to date by our current, former and prospective customers who were impacted by the 2021 cyberattack. In connection with the class action settlement and the separate settlements, we recorded a total pre-tax charge of approximately $400 million in the second quarter of 2022. During the years ended December 31, 2024 and 2023, we recognized $105 million and $50 million, respectively, in reimbursements from insurance carriers for costs incurred related to the August 2021 cyberattack, which is included as a reduction to Selling, general and administrative expenses on our Consolidated Statements of Comprehensive Income. There were no reimbursements recognized during the year ended December 31, 2025.

We have also received inquiries and contested legal proceedings from various government agencies, law enforcement and other governmental authorities related to the August 2021 cyberattack, which could result in substantial fines or penalties. We reached an agreement with the FCC, which was announced on September 30, 2024, to resolve one of those inquiries. We will continue to cooperate fully with the other agencies and regulators inquiring about the matter with an aim to resolve all of these matters. While we hope to resolve them in the near term, we cannot predict the timing or outcome of any of these matters or whether we may be subject to further regulatory inquiries, investigations, or enforcement actions.

In light of the inherent uncertainties involved in such matters, and based on the information currently available to us, in addition to the previously recorded pre-tax charge of approximately $400 million noted above, we believe it is reasonably possible that we could incur additional losses associated with these proceedings and inquiries, and we will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future actions, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition, cash flows and operating results.

On June 17, 2022, plaintiffs filed a putative antitrust class action complaint in the Northern District of Illinois, Dale, et al. v. Deutsche Telekom AG, et al., Case No. 1:22-cv-03189, against DT, T-Mobile, and SoftBank, alleging that the Sprint Merger violated the antitrust laws and harmed competition in the U.S. retail cell service market. Plaintiffs seek injunctive relief and trebled monetary damages on behalf of a purported class of AT&T and Verizon customers whom plaintiffs allege paid artificially inflated prices due to the Sprint Merger. We are vigorously defending this lawsuit, but we are unable to predict the potential outcome.

On January 5, 2023, we identified that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization. Based on our investigation, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information, such as the number of lines on the account and plan features. The result from our investigation indicates that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. We believe that the bad actor first retrieved data through the impacted API starting on or around November 25, 2022. We have notified individuals whose information was impacted consistent with state and federal requirements.

In connection with the January 2023 cyberattack, we became subject to consumer class actions and regulatory inquiries, to which we will continue to respond in due course and may incur significant expenses. However, we cannot predict the timing or outcome of any of these potential matters or whether we may be subject to additional legal proceedings, claims, regulatory inquiries, investigations, or enforcement actions.

On February 25, 2025, a purported Company shareholder filed a putative class action and derivative lawsuit in the Delaware Court of Chancery under the caption Palkon v. Deutsche Telekom AG, et al., Case No. 2025-0211-PAF, against four DT entities, our current directors, and certain of our former directors, asserting breach of fiduciary duty and unjust enrichment claims relating to our 2022 Stock Repurchase Program and our 2023-2024 Stockholder Return Program. We are also named as a nominal defendant in the lawsuit. We are unable to predict the potential outcome of these claims.