Business Context and Reporting Period
This Form 8-K Current Report was filed by AMERCO (parent company of U-Haul Holding Co) on September 9, 2022. The filing discloses a data security incident involving U-Haul International, Inc.'s information technology network.
Key Financial Metrics
The filing does not provide specific financial metrics such as revenue, profit, cash flow, margins, debt, or liquidity. The report focuses exclusively on the disclosure of a cybersecurity event.
Material Changes and Incident Details
- Incident Type: Compromise of two unique passwords for U-Haul's contract search tool.
- Timeline: Unauthorized access occurred between November 5, 2021, and April 5, 2022. The investigation concluded on August 1, 2022.
- Data Accessed: Certain customer contracts, including names, dates of birth, and driver's license numbers.
- Systems Excluded: Financial, payment processing, and email systems were not involved.
- Response: U-Haul contained the incident, enhanced security measures, engaged cybersecurity experts, and is notifying impacted customers and authorities. Identity protection services are being offered at no charge.
Management Commentary, Risks, and Outlook
Management states that the Company does not believe the incident will have a material impact on its business or financial condition. However, the filing includes forward-looking statements cautioning that actual results could differ due to risks including ongoing assessment of the incident, potential legal and reputational risks, and the effectiveness of additional security safeguards. The Company assumes no obligation to update these statements except as required by law.
Investor Verification Checklist
- Verify the scope of customer data accessed (names, DOB, driver's license numbers) versus financial data (confirmed not accessed).
- Monitor for future regulatory fines, lawsuits, or costs related to the incident that could impact financial statements.
- Review the effectiveness of the new security safeguards implemented by U-Haul.
- Check subsequent filings for updates on the number of impacted customers and the status of notifications.