Reputable outlets only (Reuters, WSJ, CNBC, Barron's, and peers). More on Google News ↗
What Changed
Risk factors · Feb 20, 2025 → Feb 20, 2026
239 added · 253 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
We continue to take steps designed to limit our cyber risks, and although we maintain cyber insurance, coverage may be limited by deductibles, exclusions, and caps, and may not fully offset losses. 23 Table o f Contents Moreover, as a contractor to the Department of Defense (“DoD”), we are contractually required to protect “controlled unclassified information” and comply with the DoD’s cybersecurity requirements, including the security controls specified in the National Institute of Standards and Technology Special Publication 800-171 (“NIST SP 800-171”).
Due to the nature of our operations, we have been, and expect to continue to be impacted by regulatory developments related to climate change, including, for example, the direct regulation of greenhouse gas emissions or carbon policies that could result in a tax on such emissions.
The use of AI in internal operations may create governance, operational, cybersecurity, privacy, and regulatory risks that could adversely affect the Company's business and results of operations. 20 Table o f Contents We operate in an intensely competitive industry, and existing and future competitive pressures could harm our performance.
These assets are vulnerable to significant harm from events such as customer or competitor disputes, cyber-attacks, service outages, data breaches, internal control deficiencies, performance failures, compliance violations, employee misconduct, government investigations, or litigation.
Additionally, the risk of reputational harm associated with unauthorized disclosure of confidential information or customer data may increase if employees misuse social networking platforms or emerging technologies, including generative AI tools.
Any such harm could diminish the value and effectiveness of our brands, reduce investor confidence, and erode customer and employee loyalty, ultimately having a material adverse impact on the value of our securities. 22 Table o f Contents We could be materially impacted by cyber-attacks.
We and our third-party partners and customers are frequent targets of increasingly sophisticated cyber-attacks, including distributed denial-of-service, ransomware, malware, viruses, credential harvesting, man-in-the-middle, software vulnerability exploitation, and social engineering.
Our efforts to implement sound information security and business continuity programs cannot ensure the integrity of our systems and successful attacks could materially disrupt operations, compromise data, damage our reputation, trigger regulatory investigations or litigation, or result in significant costs.
As further described in Item 1C “Cybersecurity” of this annual report, cyber-attacks originate from multiple sources and manifest in diverse ways, potentially exposing personally identifiable information, customer data, or protected health information, subjecting us to stringent domestic and foreign data protection laws.
Consequences of a successful attack could include operational disruption, data loss or exposure, regulatory penalties, reputational harm, customer attrition, service credits or costly retention incentives, costly remediation, litigation, and loss of certifications.
Our business could be adversely affected if these parties fail to deliver products or services on acceptable terms due to operational disruptions, increased pricing, security incidents, litigation, financial distress, bankruptcy, or strategic changes.
Any failure or deficiency in these controls could result in inaccurate disclosures, financial reporting errors, or noncompliance with SEC requirements, which could materially and adversely affect our reputation, financial condition, or results of operations.
No longer disclosed
As previously disclosed in our 2023 reports to the SEC and various 2024 media reports, (i) sophisticated threat actors accessed our internal information technology systems in 2023 and 2024 and (ii) we experienced a ransomware attack on a limited number of our servers in 2023.
For example, if we are not in compliance with FCC measures by the end of the CAF II or RDOF programs, we could incur substantial penalties or forfeitures, including but not limited to being suspended or disbarred from future governmental programs or contracts, which could have a material adverse impact on our financial condition.
These modernization efforts will require efficient allocation of resources, development capacity, greater use of artificial intelligence (“AI”) and other emerging technologies, access to subject-matter experts, development of a sustainable and resilient operating model, advanced project management capabilities, and successful collaboration among personnel with differing expertise.
However, our corporate reputation is susceptible to material damage by events such as disputes with customers or competitors, cyber-attacks, service outages, data breaches, internal control deficiencies, performance failures, compliance violations, employee misconduct, government investigations or legal proceedings.
In addition, the reputational risk of unauthorized disclosure of confidential company or customer data could increase to the extent our employees inappropriately use social networking sites or other emerging technologies, such as generative AI tools.
Damage to our reputation could also reduce the value and effectiveness of the Lumen brand name and could reduce investor confidence in us, having a material adverse impact on the value of our securities. 23 Table of Contents We could be harmed by cyber-attacks.
Cyber-attacks could (i) disrupt the proper functioning of our networks and systems, which could in turn disrupt the operations of our customers, (ii) result in the destruction, loss, theft, misappropriation or release of proprietary, confidential, sensitive, classified or otherwise valuable information of ours, our employees, our customers or our customers’ end users, (iii) require us to notify customers, regulatory agencies or the public of data incidents, (iv) damage our reputation or result in a loss of business, (v) require us to provide credits for future service to our customers or to offer expensive incentives to retain customers, (vi) subject us to claims by our customers or regulators for damages, fines, penalties, license or permit revocations or other remedies, (vii) result in the loss of industry certifications or (viii) require significant management attention or financial resources to remedy the resulting damages or to change our systems.
Moreover, the risk of incidents is likely to continue to increase due to several factors, including (i) the increasing use of machine learning, AI and other sophisticated techniques to initiate cyber and phishing attacks, (ii) the wider accessibility of cyber-attack tools that can circumvent security controls and evade detection, which can delay and limit our ability to accurately assess and fully remediate the impact of the attack, and (iii) growing threats from Chinese, Russian and other state actors due to heightened geopolitical tensions and rivalries, and the attendant increased possibility of cyber warfare targeting us in the event of a direct conflict.
Although we maintain insurance coverage that may, subject to policy terms and conditions (including self-insured deductibles, coverage restrictions and monetary coverage caps), cover certain aspects of our cyber risks, such insurance coverage may be unavailable or insufficient to cover our losses. 24 Table of Contents We could be harmed by outages in our network or various platforms, or other failures of our services.
Our operations could be adversely affected in the future if any of these vendors are unable or unwilling for any reason to continue to deliver their products or services on terms acceptable to us, including due to business interruptions, security incidents, litigation, financial distress, bankruptcy or changes in their operations or business strategies. 25 Table of Contents Reliance on key licensors.
For all these reasons, our use of AI could materially harm our business, operations or reputation. 28 Table of Contents We have been accused of infringing the intellectual property rights of others and will likely face similar accusations in the future.
Lumen Technologies, Inc.’s senior secured credit facilities also contain financial maintenance covenants which are described further in Note 7—Long-Term Debt and Credit Facilities. 31 Table of Contents The failure of Lumen Technologies, Inc. or any of its subsidiaries to comply with the above-described restrictive or financial covenants could result in an event of default, which, if not cured or waived, could accelerate our debt repayment obligations.