U-Haul Data Breach Affects 67,000 Across US, Canada

U-Haul has confirmed it experienced a data breach that compromised the data of around 67,000 customers across the U.S. and Canada.

The breach, which took place between July 20 and Oct. 2 last year, was disclosed in December in a court filing with the state of Maine. According to the filing, customer names, date of birth and driver’s license numbers were acquired in the breach.

U-Haul has now alerted customers of the incident, in a notification letter emailed to the affected parties.

“U-Haul learned on Dec. 5, 2023, that legitimate credentials were used by an unauthorized party to access a system U-Haul Dealers and Team Members use to track customer reservations and view customer records,” U-Haul wrote in the letter. “We initiated our response protocol and a cybersecurity firm was engaged to conduct an investigation.”

U-Haul noted that hackers were unable to access its payment network, meaning customer’s payment details were not compromised in the attack. 

"The customer record system that was involved is not part of our payment system," U-Haul said. "No payment card data was involved."

While no additional details about the breach have been released, U-Haul said it has reset passwords and credentials for impacted accounts and has established a call center for affected customers to call for more information about the incident.

Related:Bank of America Data Breach Impacts 57,000

This is not U-Haul’s first data breach. 

The company announced in September of 2022 that hackers accessed a customer contract search tool, allowing access to rental contracts for U-Haul customers, and compromising customer names, driver’s licenses and state identification numbers.