AT&T INC.

05 of Form 8-K relating to the copying of mobile customer call data. Due to the complexity and interconnectedness of our systems and those of our suppliers, vendors and other service providers, the process of enhancing our protective measures can itself create a risk of systems disruptions and security issues. Further, the use of artificial intelligence and machine learning by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our suppliers, vendors and other service providers. In addition, despite our efforts to detect unlawful intrusions, an attack may persist for an extended period of time before being detected, and, following detection, it may take considerable time for us to obtain sufficient information about the nature, scope and timing of the incident as well as the impact or reasonably likely impact on us. Indeed, as cyberattacks become increasingly sophisticated, a post-attack investigation may not be able to ascertain the entire scope of the attack’s impact. Extensive and costly efforts are undertaken to develop and test systems before deployment and to conduct ongoing monitoring and updating to prevent and withstand such attacks. While we may have contractual rights to assess the effectiveness of many of our suppliers’ and vendors’ systems and protocols, we cannot know or assess the effectiveness of all of our providers’ systems and controls at all times.