HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

U-Haul International, Inc.

bd_b8082447aed60375 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 12, 2022

Filed

Sep 12, 2022

To disclose

9 weeks

Affected

7,948state residents only

Linked

11 filings

Confidence

65%

Full breach record for U-Haul International, Inc. →4 incidents on file

U-Haul International, Inc. notified the New Hampshire Attorney General of a cybersecurity incident affecting 7,948 NH residents. Unauthorized parties used compromised credentials to access a customer contract search tool between November 5, 2021, and April 5, 2022. The accessed data included names and driver's license/state ID numbers. U-Haul engaged a cybersecurity firm, secured the account, and provided one year of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 249 days

discovery → filing · 9 weeks / 62 days

Nov 5, 2021

Begins

Jul 12, 2022

Discovered

Sep 12, 2022

Filed

vs. sector median

+1 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

South Carolina State AGbd_0dfe50ed1dc2b8df2022-09-09 · +3dCandidate
Delaware State AGbd_1ef6523a576cc9462022-09-09 · +3dVerified
Massachusetts State AGbd_2fe2158957dbcca22022-09-09 · +3dVerified
Washington State AGbd_45c94d5ea35f726d2022-09-09 · +3dVerified

Show 6 more filings ↓up to 3d gap

Hawaii State AGbd_78979647f544ae592022-09-09 · +3dVerified
Oregon State AGbd_939d4740c11bcd9e2022-09-09 · +3dVerified
California State AGbd_9476e19e00a93d972022-09-09 · +3dVerified
Indiana State AGbd_b1aa1cd9dfff0a562022-09-09 · +3dVerified
Maine State AGbd_c49cf3b69da05aab2022-09-09 · +3dVerified
Montana State AGbd_f7f4e0374a574f482022-09-09 · +3dVerified

Name: Baker & Hostetler LLP (on behalf of U-Haul International, Inc.)
norm: baker hostetler llp on behalf of u haul

Name: U-Haul International, Inc.
norm: u haul
Industry: Retail & Consumerllm

Discovered: Jul 12, 2022
Breach occurred: Nov 5, 2021 – Apr 5, 2022
Undetected for: 249 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 9, 2022
Affected individuals: 7,948state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure the account
Launched an investigation
A cybersecurity firm was engaged to assist
Emailing or mailing via USPS First Class Mail... notification letters to these New Hampshire residents
Offering impacted individuals a complimentary, one-year membership to credit monitoring and identity theft protection services
Established a dedicated, toll-free call center
Changes made: Take steps to enhance its existing security protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

South Carolina State AGSep 9 · first

Delaware State AGSep 9 · first

Massachusetts State AGSep 9 · first

Washington State AGSep 9 · first

Hawaii State AGSep 9 · first

Oregon State AGSep 9 · first

California State AGSep 9 · first

Indiana State AGSep 9 · first

Maine State AGSep 9 · first

Montana State AGSep 9 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/uhaul-international-20220912.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2022
Raw hash: e1e0dacdb0510457e2639b125a50ad3a12ad633ea58ee10f10ebfa2a572fbcdb

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityBaker & Hostetler LLP (on behalf of U-Haul International, Inc.)

Victim entityU-Haul International, Inc.

Incidentdiscovered Jul 12, 2022

Stated responseTook steps to secure the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov