Want to see TMUS full AI Analyst Report?
T Mobile US (TMUS) Risk Analysis
Risk Overview Q2, 2026
Risk Change Over Time
- Cyber Security - Risk 1We have experienced cyberattacks and may experience disruptions, data loss and other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business.
Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account, and payment information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, "Confidential Information"). Additionally, to offer services to our customers and operate our business, we utilize several applications and systems, including those we own and operate, such as our wireless network, as well as others provided to us by third parties, such as cloud service providers and SaaS companies (collectively, "Systems"). We are subject to persistent cyberattacks and threats to our business from bad actors seeking to gain unauthorized access to Confidential Information and to compromise Systems. They are perpetrated by a variety of groups and persons, including nation state-sponsored parties, malicious actors, employees, contractors, and other third parties. Some of these bad actors reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable. Cyberattacks against companies like ours are increasing in frequency and scope of potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and detect incidents successfully in every instance. In some cases, these bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information. In other cases, these bad actors obtain unauthorized access to Confidential Information by exploiting insider access or utilizing login credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means. Other bad actors aim to cause serious operational disruptions to our business and Systems through ransomware or distributed denial of service attacks. Moreover, the amount and scope of insurance that we maintain against losses resulting from any such incidents or security breaches may not be sufficient to cover our losses or otherwise adequately compensate us for any disruptions to our business that may result. Although we regularly work to identify, track, and remedy security vulnerabilities, given the complex nature of our Systems and the tools that are available to us, we may be unable to identify vulnerabilities in a timely manner, or to apply patches or compensating measures that address such vulnerabilities, before bad actors can exploit them. The exploitation of a security vulnerability before patches or measures are applied could materially compromise Confidential Information and Systems. In addition, we routinely rely upon third-party providers whose products and services are used in our business. These third-party providers have experienced, and will continue to experience, cyberattacks that involve attempts to access our Confidential Information and/or to create operational risk that could materially and adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information. Additionally, our Systems include components from third parties or fourth parties we do not control and may have compromises, defects, flaws, or design errors unknown to us. As a result of the previously disclosed cyberattacks in August 2021 and January 2023, we incurred significant costs in connection with, among other things, responding to and resolving mass arbitration claims, multiple class action lawsuits, and an FCC investigation. For more information on the foregoing, see "– Contingencies and Litigation – Litigation and Regulatory Matters" in Note 14 – Commitments and Contingencies of the Notes to the Condensed Consolidated Financial Statements. In addition to the August 2021 cyberattack and the January 2023 cyberattack, we have experienced unrelated, non-material incidents involving unauthorized access to certain Confidential Information and Systems. Typically, these incidents have involved attempts to commit fraud by taking control of a customer's phone line, often by exploiting insider access or using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers' private information, including payment information, financial data, Social Security numbers or passwords, and our intellectual property. Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers. Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations, including while we adapt complex digital efforts. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers, including through our cybersecurity programs or policies. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers' systems and protocols, we do not have the means to always know or assess the effectiveness of all of our providers' systems and controls. We cannot provide any assurances that actions taken by us, or our third-party providers, including through our cybersecurity programs or policies, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or Systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. We expect threat actors to continue to increase in sophistication, including through the use of increasingly advanced AI tools, which may accelerate the identification and exploitation of vulnerabilities, enable evasion of security controls, and reduce the time between discovery and attempted exploitation. Although AI may also enhance defensive capabilities, the pace at which vulnerabilities can be identified and weaponized may outstrip our ability, and that of our third-party providers, to test and deploy patches or other mitigating measures across complex systems. Efforts to accelerate remediation may also increase the risk of operational disruptions or system instability, and the continued development and integration of AI may introduce new and evolving cybersecurity risks. These dynamics may heighten our exposure to cybersecurity incidents and related adverse impacts on our business, reputation, financial condition, and operating results. In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities or unsophisticated security measures, which expose us to significant cybersecurity, operational, and financial risks. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.
Risk Highlights Q2, 2026
Risk Word Cloud
Risk Factors Full Breakdown - Total Risks 27
- Share Price & Shareholder Rights - Risk 1Future sales of our common stock by DT and foreign ownership limitations by the FCC could have a negative impact on our stock price and decrease the value of our stock.
We cannot predict the effect, if any, that market sales of shares of our common stock by DT will have on the prevailing trading price of our common stock. Sales of a substantial number of shares of our common stock could cause our stock price to decline. We and DT are parties to the Second Amended and Restated Stockholders' Agreement pursuant to which DT is free to transfer its shares in public sales without notice, as long as such transactions would not result in a third party owning more than 30% of the outstanding shares of our common stock. If a transfer were to exceed the 30% threshold, it would be prohibited unless the transfer were approved by our Board of Directors, or the transferee were to make a binding offer to purchase all of the other outstanding shares on the same price and terms. The Second Amended and Restated Stockholders' Agreement does not otherwise impose any other restrictions on the sales of common stock by DT. Moreover, the Second Amended and Restated Stockholders' Agreement generally requires us to cooperate with DT to facilitate the resale of our common stock or debt securities held by DT under shelf registration statements we have filed. DT has incrementally sold limited amounts of shares of our common stock in the open market. Any additional sale of shares of our common stock by DT (other than in transactions involving the purchase of all of our outstanding shares) could significantly increase the number of shares available in the market, which could cause a decrease in our stock price. In addition, even if DT does not sell a large number of its shares into the market, their rights to transfer a large number of shares into the market could depress our stock price. Furthermore, under existing law, no more than 20% of an FCC licensee's capital stock may be directly owned, or no more than 25% indirectly owned, or voted by non-U.S. citizens or their representatives, by a foreign government or its representatives or by a foreign corporation. If an FCC licensee is controlled by another entity, up to 25% of that entity's capital stock may be owned or voted by non-U.S. citizens or their representatives, by a foreign government or its representatives or by a foreign corporation. Foreign ownership above the 25% holding company level may be allowed if the FCC finds such higher levels consistent with the public interest. The FCC has ruled that higher levels of foreign ownership, even up to 100%, are presumptively consistent with the public interest with respect to investors from certain nations. If our foreign ownership by previously unapproved foreign parties were to exceed the permitted level without further FCC authorization, the FCC could subject us to a range of penalties, including an order for us to divest the foreign ownership in part, fines, license revocation or denials of license renewals. If ownership of our common stock by an unapproved foreign entity were to become subject to such limitations, or if any ownership of our common stock violates any other rule or regulation of the FCC applicable to us, our Certificate of Incorporation provides for certain redemption provisions at a pre-determined price which may be less than fair market value. These limitations and our Certificate of Incorporation may limit our ability to attract additional equity financing outside the United States and decrease the value of our common stock.
- Share Price & Shareholder Rights - Risk 2We cannot guarantee that our current and future stockholder return programs will be fully utilized or that they will enhance long-term stockholder value.
Our Board of Directors has authorized, and may from time to time authorize, stockholder return programs, consisting of repurchases of shares of our common stock, the payment of cash dividends, or both. The specific timing and amount of any share repurchases and any dividend payments under any stockholder return program will depend on prevailing share prices, general economic and market conditions, Company performance and other considerations, such as whether the Company determines that there are other uses for the funds currently authorized for the program that would be more advantageous for our business. In addition, the specific timing and amount of any dividend payments are subject to declaration on future dates by the Board of Directors in its sole discretion. Any stockholder return program could impact our cash flows, affect the trading price of our common stock, and increase volatility. We cannot guarantee that any stockholder return program will be fully consummated or that it will enhance long-term stockholder value. Our current and future stockholder return programs do not, and will not, obligate the Company to acquire any particular amount of common stock or to declare and pay any particular amount of dividends, and any program may be suspended or discontinued at any time at the Company's discretion. Any announcement of termination of any program may result in a decrease in the price of our common stock.
- Share Price & Shareholder Rights - Risk 3DT controls a majority of the voting power of our common stock and the T-Mobile trademarks we utilize in our business and may have interests that differ from the interests of our other stockholders.
DT controls a majority of the voting power of our common stock and therefore we are a "controlled company," as defined in the NASDAQ Stock Market LLC ("NASDAQ") listing rules, and we are not subject to NASDAQ requirements that would otherwise require us to have a majority of independent directors, a nominating committee composed solely of independent directors or a compensation committee composed solely of independent directors. Accordingly, our stockholders will not be afforded the same protections as stockholders of other NASDAQ-listed companies generally receive with respect to corporate governance for so long as we rely on these exemptions from the corporate governance requirements. In addition, pursuant to our Certificate of Incorporation and the Second Amended and Restated Stockholders' Agreement, as long as DT beneficially owns 30% or more of our outstanding common stock, we are restricted from taking certain actions without DT's prior written consent, including (i) incurring indebtedness above certain levels based on a specified debt to cash flow ratio, (ii) taking any action that would cause a default under any instrument evidencing indebtedness involving DT or its affiliates, (iii) acquiring or disposing of assets or entering into mergers or similar acquisitions in excess of $1.0 billion, (iv) changing the size of our Board of Directors, (v) subject to certain exceptions, issuing equity of 10% or more of the then-outstanding shares of our common stock, or issuing equity to redeem debt held by DT, (vi) repurchasing or redeeming equity securities or making any extraordinary or in-kind dividend other than on a pro rata basis, or (vii) making certain changes involving our CEO. We are also restricted from amending our Certificate of Incorporation and bylaws in any manner that could adversely affect DT's rights under the Second Amended and Restated Stockholders' Agreement for as long as DT beneficially owns 5% or more of our outstanding common stock. These restrictions could prevent us from taking actions that our Board of Directors might otherwise determine are in the best interests of the Company and our stockholders, or that may be in the best interests of our other stockholders. DT effectively has control over all matters submitted to our stockholders for approval, including the election or removal of directors, changes to our Certificate of Incorporation, a sale or merger of our Company and other transactions requiring stockholder approval under Delaware law. DT's controlling interest may have the effect of making it more difficult for a third party to acquire, or discouraging a third party from seeking to acquire, the Company and DT, as the controlling stockholder, may have strategic, financial, or other interests different from those of our other stockholders, including as the holder of a portion of our debt and as the counterparty in a number of commercial arrangements, and may make decisions adverse to the interests of our other stockholders. In addition, we license certain trademarks from DT, including the right to use the trademark "T-Mobile" as a name for the Company and our flagship brand under a trademark license agreement, as amended, with DT. As described in more detail in our Proxy Statement on Schedule 14A filed with the SEC on April 18, 2025 under the heading "Transactions with Related Persons and Approval," we are obligated to pay DT a royalty in an amount equal to 0.25% (the "royalty rate") of the net revenue (as defined in the trademark license) generated by products and services sold by the Company under the licensed trademarks subject to a cap of $80 million per calendar year through December 31, 2028. We and DT are obligated to negotiate a new trademark license when (i) DT has 50% or less of the voting power of the outstanding shares of capital stock of the Company or (ii) any third party owns or controls, directly or indirectly, 50% or more of the voting power of the outstanding shares of capital stock of the Company, or otherwise has the power to direct or cause the direction of the management and policies of the Company. If we and DT fail to agree on a new trademark license, either we or DT may terminate the trademark license and such termination shall be effective, in the case of clause (i) above, on the third anniversary after a notice of termination and, in the case of clause (ii) above, on the second anniversary after a notice of termination. A further increase in the royalty rate or termination of the trademark license could have a material adverse effect on our business, financial condition, and operating results.
- Share Price & Shareholder Rights - Risk 4Our Certificate of Incorporation designates the Court of Chancery of the State of Delaware as the sole and exclusive forum for certain actions and proceedings, which could limit the ability of our stockholders to obtain a judicial forum of their choice for disputes with the Company or its directors, officers, or employees.
Our Certificate of Incorporation provides that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware shall be the sole and exclusive forum for (i) any derivative action or proceeding brought on behalf of the Company, (ii) any action asserting a claim of breach of a fiduciary duty owed by any director, officer or employee of the Company to the Company or its stockholders, (iii) any action asserting a claim arising pursuant to any provision of the General Corporation Law of the State of Delaware, the Certificate of Incorporation or the Company's bylaws, or (iv) any other action asserting a claim arising under, in connection with, and governed by the internal affairs doctrine. This choice of forum provision does not waive our compliance with our obligations under the federal securities laws and the rules and regulations thereunder. Moreover, the provision does not apply to suits brought to enforce a duty or liability created by the Exchange Act or by the Securities Act of 1933, as amended. This choice of forum provision may increase costs to bring a claim, discourage claims, or limit a stockholder's ability to bring a claim in a judicial forum that the stockholder finds favorable for disputes with the Company or its directors, officers or employees, which may discourage such lawsuits against the Company and its directors, officers and employees, even though an action, if successful, might benefit our stockholders. Alternatively, if a court were to find the choice of forum provision to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such matters in other jurisdictions, which could increase our costs of litigation and adversely affect our business and financial condition.
See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.