UHaul Data Breach

Usually when they "found no evidence that other systems were compromised", they mean that their auditing and logging is so bad that they literally cannot tell ;-)

To give them the benefit of the doubt, maybe those 2 compromised accounts were only able to access that tool.

A more weasley sentence would be "Evidence so far has shown that the access was limited to the customer contract search tool.", or another company had something along the lines of "Evidence so far show that no sensitive customer information was compromised."

Which can be PR talk for "We have no intrusion detection tools so we don't know what data they managed to extract".

Why would you expect a tech company to do a better job securing this information? I've worked for both kinds quite a bit at this point and don't really see any trends either way other than "most don't really care and there usually aren't consequences so why would they" and that's universal.

>I had full expectation that a non-tech company like U-Hual would be fully incompetent to properly store such a trove of identity information,

Why would a tech company be any better at handling data securely? More engineers doesn't mean better security.

My last experience with U-Haul (October 2021 to March 2022) is indeed my last experience with them.

Over and above the standard incompetence stemming from franchisees somehow working against an umbrella organization for scheduling, pickup, dropoff, etc they somehow superimposed somebody else's data (including DL, name, address, last 4 of credit card) onto our reservation. This meant that when they couldn't contact the (wrong) phone number to confirm scheduled drop off of equipment, they just canceled it. This in turn delayed the whole move by a day, since our local office couldn't re-dispatch on the same day, because ... reasons? Honestly, I wouldn't be surprised if this security incident was in fact just their own lousy database implementation leaving things exposed.

The entire moving industry seems built on the understanding that, regardless of what the law says, the customer is entrusting the entirety of their earthly possessions to this industry they (hopefully) engage with once a decade or more. Every aspect of the process has this thinly veiled extortive quality to it. I'm really not sure how to engineer that out. There's little real recourse, as there are few frequent repeat customers to "just take their money elsewhere".

Someone mentioned (and deleted) it'd be better to make friends with someone who has access to a box truck. My + two cents:

This feels like valuable advice across multiple industries.

Big companies have no one's name attached, not the way people do. So the price of a convenient box truck is playing by their rules, submitting id, and trusting them to take care of their responsiblities. If they don't then, no one is responsible or truly looks bad. No single relationship is broken. So no great incentive on their part to care. Meanwhile, friends, or even paid acquaintances, have no incentive to squeeze past at most some cash or favor. And if they squeeze to hard they, as a person will face social consequences (sociopaths exempt, to a degree).

Also happened to me but my experience at that time was so bad that I'd never use them again anyway.

Aside from issues with my reservation, they charged my card ~$2500 3 months_after_ I had returned the trailer I rented. Claimed it was returned late and to an entirely different state. Luckily I am a receipt hoarder and had all the evidence that I returned it on time. Unluckily though it took _weeks_ to get my money back from UHaul and several calls to hassle them about getting it fixed.

UHaul not even once.

I understand that sentiment, but IT Security seems to be at a point where it's unmanageable...especially for non-tech companies.

I don't see how a CEO would reasonably assess the state of their IT security. Who would you trust to give an accurate state, remediation plan, etc? There's so many ways to do it wrong and so many different opinions, directions, etc. It feels like even those that throw lots of money at it get mediocre improvements in security but with notable hits to productivity.

In other words, I think there's very few non-tech companies that aren't in the same spot as U-Haul. And probably quite a few highly technical companies also...witness Uber's recent issues.