UHaul Data Breach

We are writing to inform you of an incident that involved some of your information. We are providing this notice to explain the incident and measures we have taken, and also to provide some steps you can take in response.

What Happened? We detected a compromise of two unique passwords that were used to access a customer contract search tool that allows access to rental contracts for U-Haul customers. The search tool cannot access payment card information; no credit card information was accessed or acquired. Upon identifying the compromised passwords, we promptly changed the passwords to prevent any further unauthorized access to the search tool and started an investigation. Cybersecurity experts were engaged to identify the contracts and data that were involved. The investigation determined an unauthorized person accessed the customer contract search tool and some customer contracts. None of our financial, payment processing or U-Haul email systems were involved; the access was limited to the customer contract search tool.

What Information Was Involved? On August 1, 2022, our investigation determined some rental contracts were accessed between November 5, 2021, and April 5, 2022. After an in-depth analysis, our investigation determined on September 7, 2022, the accessed information includes your name and driver's license or state identification number

Well its a nice email to wake up to. The first time I ever rent a uHaul and my DL is leaked.

A more weasley sentence would be "Evidence so far has shown that the access was limited to the customer contract search tool.", or another company had something along the lines of "Evidence so far show that no sensitive customer information was compromised."

Which can be PR talk for "We have no intrusion detection tools so we don't know what data they managed to extract".

I don't see how a CEO would reasonably assess the state of their IT security. Who would you trust to give an accurate state, remediation plan, etc? There's so many ways to do it wrong and so many different opinions, directions, etc. It feels like even those that throw lots of money at it get mediocre improvements in security but with notable hits to productivity.

In other words, I think there's very few non-tech companies that aren't in the same spot as U-Haul. And probably quite a few highly technical companies also...witness Uber's recent issues.

I did not like the taking a picture of the entire license at all, but was stuck.

I had full expectation that a non-tech company like U-Hual would be fully incompetent to properly store such a trove of identity information, and here it is - crackers wandering around in their system for six months, and they "have no evidence" of further intrusion, meaning they don't even have the logs to verify or the capability to read the logs, so they actually have no evidence that other data was not accessed (absence of evidence is not evidence of absence)...

I'll sure as hell be avoiding UHaul if at all possible in the future...