U-Haul Holding Co NV

The following discussion of potential risks under the caption ‘We are highly dependent upon our automated systems and the Internet for managing our business’ contains material updates to the risk factor described under the same heading in the Company’s Annual Report on Form 10-K for the fiscal year ended March 31, 2023. Other than the following updated risk factor, we are not aware of any material updates to the risk factors described in that Annual Report.

We are highly dependent upon our automated systems and the Internet for managing our business.

Our information systems are largely Internet-based, including our point-of-sale reservation system, payment processing and telephone systems. While our reliance on this technology lowers our cost of providing service and expands our abilities to better serve customers, it exposes us to various risks, including natural and man-made disasters, terrorist attacks and cyber-attacks. We have put into place extensive security protocols, backup systems and alternative procedures to mitigate these risks. However, disruptions or breaches, detected or undetected by us, for any period of time in any portion of these systems could adversely affect our results of operations and financial condition and inflict reputational damage.

In addition, the provision of service to our customers and the operation of our networks and systems involve the storage and transmission of proprietary information and sensitive or confidential data, including personal information of customers, system members and others. Our information technology systems may be susceptible to computer viruses, attacks by computer hackers, malicious insiders or catastrophic events. Hackers, acting individually or in coordinated groups, may also launch distributed denial of service attacks or ransom or other coordinated attacks that may cause service outages or other interruptions in our business and access to our data. In addition, breaches in security could expose us, our customers, or the individuals affected, to a risk of loss or misuse of proprietary information and sensitive or confidential data.

In 2022 and 2021, we experienced a cybersecurity incident, which is described in this Form 10-Q under the heading “Item 2 Management’s Discussion and Analysis of Financial Condition and Results of Operation – Cybersecurity Incident”. We have also experienced and continue to experience a significant increase in the number of attempted attacks on our technology systems, which could increase the likelihood that any of the risks described in this risk factor may be realized. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently, may be difficult to detect for a long time and often are not recognized until launched against a target. As a result, we may be unable to anticipate these techniques or to implement adequate preventative or remedial measures.

Any of these occurrences could result in disruptions in our operations, the loss of existing or potential customers, damage to our brand and reputation, and litigation and potential liability for the Company. In addition, the cost and operational consequences of implementing further data or system protection measures could be significant, and our efforts to deter, identify, mitigate and/or eliminate any security breaches may not be successful.