Library, Fitness & Home · Moving/Storage · Structural / no discrete incident
U-Haul
Headline
Two confirmed separate breaches, and the repetition is the finding.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Two confirmed separate breaches, and the repetition is the finding. U-Haul's data is also distinctive: a rental record is a documented move - origin address, destination address, date - which is precisely the information that identifies someone who has relocated to get away from another person. Domestic violence advocates treat address change as the single most protected fact about a person, and a moving company holds it by definition, twice over. U-Haul additionally requires a driver's licence scan at counter, so identity documents sit alongside it.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
TWO CONFIRMED, SEPARATE DATA BREACHES: (1) A breach from November 5, 2021 to April 5, 2022 (SEVEN MONTHS undetected) occurred after hackers obtained two PASSWORDS controlling U-Haul's customer-contract-search tool, exposing customers' names, birthdates, and DRIVER'S LICENSE NUMBERS — the lawsuit specifically alleges U-Haul continued storing this data UNENCRYPTED in an internet-accessible environment despite widely-available FBI/CISA warnings about aggressive cyberattack targeting, and raises a Driver's Privacy Protection Act violation claim specifically (a federal law protecting DMV-sourced license data). (2) A SECOND, separate breach occurred in December 2023. U-Haul settled class litigation for $5.085 MILLION (claims deadline Oct 15, 2024; class limited to California residents who received breach notices), with an estimated pro-rata payout of approximately $100 per claimant.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy uhaul.com/Privacy/ | Not fetched yet | NO (HTML only) |
| Terms of service uhaul.com/Terms/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.