AT&T INC.

Current report

Cyberattacks impacting our networks, systems or data or those of our suppliers or vendors may have a material adverse effect on our operations or results of operations.

Current report

Cyberattacks – including through the use of malware, computer viruses, distributed denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means for obtaining unauthorized access to or disrupting the operation of our networks and systems or accessing our data and those of our suppliers, vendors and other service providers – could have a material adverse effect on our operations or results of operations. Cyberattacks can cause equipment or network failures, copying or loss of information, including sensitive personal information of customers or employees or proprietary information, as well as disruptions to our or our customers’, suppliers’ or vendors’ operations, which could result in significant expenses, potential investigations and legal liability, a loss of current or future customers and reputational damage. As our networks evolve, they are becoming increasingly reliant on software and cloud technologies to handle growing demands for data consumption. Cyberattacks against the Company and its suppliers and vendors have occurred in the past, will continue to occur in the future and are increasing in frequency, scope and potential harm over time. For example, in July 2024, the Company disclosed a cybersecurity incident on Item 1.05 of Form 8-K relating to the copying of mobile customer call data.

Current report

Due to the complexity and interconnectedness of our systems and those of our suppliers, vendors and other service providers, the process of enhancing our protective measures can itself create a risk of systems disruptions and security issues. Further, the use of artificial intelligence and machine learning by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our suppliers, vendors and other service providers. In addition, despite our efforts to detect unlawful intrusions, an attack may persist for an extended period of time before being detected, and, following detection, it may take considerable time for us to obtain sufficient information about the nature, scope and timing of the incident as well as the impact or reasonably likely impact on us. Indeed, as cyberattacks become increasingly sophisticated, a post-attack investigation may not be able to ascertain the entire scope of the attack’s impact.

Current report

Extensive and costly efforts are undertaken to develop and test systems before deployment and to conduct ongoing monitoring and updating to prevent and withstand such attacks. While, to date, we have not been subject to a cyberattack that has had a material adverse effect on our operations or results of operations, the preventive actions we take, or our suppliers or vendors take, to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.