Amerco (UHAL) Risk Factors

In August 2023, A.M. Best affirmed the financial strength rating ("FSR") for Oxford and Christian Fidelity Life Insurance Company ("CFLIC") of A. The FSR outlook remains stable. In addition, A.M. Best affirmed the long-term issuer credit rating ("LTICR") of "a". The LTICR outlook of these ratings is stable. Financial strength ratings are important external factors that can affect the success of Oxford's business plans. Accordingly, if Oxford's ratings, relative to its competitors, are not maintained or do not continue to improve, Oxford may not be able to retain and attract business as currently planned, which could adversely affect our results of operations and financial condition.

As of March 31, 2024, we had total debt outstanding of $6,304.0 million and operating lease liabilities of $55.0 million. Although we believe, based on existing information, that additional leverage can be supported by our operations and revenues, our existing debt could impact us in the following ways, among others: - require us to allocate a considerable portion of cash flows from operations to debt service and lease payments;- limit our flexibility in planning for, or reacting to, changes in our business and the industry in which we operate;- limit our ability to obtain additional financing; and - place us at a disadvantage compared to our competitors who may have less debt. Our ability to make payments on our debt and leases depends upon our ability to maintain and improve our operating performance and generate cash flow. To some extent, this is subject to prevailing economic and competitive conditions and to certain financial, business and other factors, some of which are beyond our control. If we are unable to generate sufficient cash flow from operations to service our debt and meet our other cash needs, including our leases, we may be forced to reduce or delay capital expenditures, sell assets, seek additional capital or restructure or refinance our indebtedness and leases. If we must sell our assets, it may negatively affect our ability to generate revenue. In addition, we may incur additional debt or leases that would exacerbate the risks associated with our indebtedness.

Terrorist attacks may negatively affect our operations and profitability. Such attacks may damage our facilities and it is also possible that our rental equipment could be involved in a terrorist attack. Although we carry excess of loss insurance coverage, it may prove to be insufficient to cover us for acts of terror using our rental equipment. Moreover, we may suffer reputational damage that could arise from a terrorist attack which utilizes our rental equipment. The consequences of any terrorist attacks or hostilities are unpredictable and difficult to quantify. We seek to minimize these risks through our operational processes and procedures; however, we may not be able to foresee events that could have an adverse effect on our operations.

We rely on information technology systems to manage and support our operations and provide products, services, and support to our customers. In connection with these activities, we store and transmit proprietary information and sensitive or confidential data, including personally identifiable information of customers, team members and others. Our reliance on these technology systems and our storage and transmission of such data exposes us to various risks, including cyberattacks or failures in all or part of our technology systems that could result in disruptions in our operations, our ability to serve our customers, or a compromise of our data security. We also face such risks through our use of third-party service providers (including banks, dealers, administrators of our medical insurance plans, and law firms), our communication and filing data with regulatory authorities and government agencies, and our other interactions with third parties, any of whom could be the source of a cyberattack on our technology systems or data. We commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents. We have implemented security protocols, backup systems and alternative procedures to mitigate these risks. We employ IT security team members that have cybersecurity experience or certifications and utilize third-party service providers and consultants to protect our systems and assist us in managing these risks. Our Board and its Audit & Cyber Committee exercise oversight of our cybersecurity risks and management's oversight of the processes and procedures that protect our systems and data. However, despite our security measures, we cannot guarantee that we will not be adversely affected by cybersecurity incidents, including hacks of our systems, denial-of-service attacks, viruses and other malicious software (malware), team member error or malfeasance, phishing attacks, security breaches, disruptions during the process of upgrading or replacing computer software or hardware, or other attacks that may jeopardize the security of information stored in or transmitted by technology systems and networks that we or third-party service providers maintain, which include cloud-based networks and data center storage. In addition, our response to cybersecurity incidents, our investments in our technology, and our controls, processes, and practices, may not be sufficient to shield us from significant losses or liability. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, may be difficult to detect, and often are not recognized until launched against a target. As a result, we may not anticipate an attack or respond adequately or timely, and the extent of a particular incident may not be immediately clear. It could take significant time before an investigation can be completed and reliable information about the incident becomes known. During an investigation, it is possible we may not know the extent of the harm, or how to remediate it, which could further adversely impact us. New regulations could result in us being required to disclose information about a cybersecurity incident before it has been fully investigated, mitigated, or resolved. Due to the risk of allegations by plaintiffs' counsel or government regulators armed with the benefit of hindsight, we may be required to disclose information about a cybersecurity incident even before we determine whether it was material. In addition, because our systems contain information about individuals and businesses, our failure to maintain the security of the data we hold, whether because of our own error or the malfeasance or errors of others, could lead to unauthorized access or the release of personally identifiable or otherwise confidential or protected information. Our failure to maintain the security of the data we hold could also violate applicable privacy, data security and other laws and subject us to lawsuits and regulatory enforcement resulting in fines. Regulators have been imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations, such as those under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act. Other U.S. states and Canadian provinces have also proposed or adopted their own data protection legislation or regulations, which are often broad in scope and subject to evolving interpretations and increasing enforcement. Some of these laws and regulations provide for statutory damages or fines even if the Company has used commercially reasonable efforts to protect its data and systems but a bad actor breaches the Company's cybersecurity defenses and gains access to personally identifiable information. Even if no party incurs any actual damages, the Company could be punished by the government for criminal cyberattacks by bad actors, and the fines or other costs imposed upon us could reach amounts that could have a material adverse effect on the Company, its results of operations, and financial condition. In addition, new and existing data privacy laws and regulations could diverge and conflict with each other in certain respects, making compliance increasingly difficult. Complying with new regulatory requirements could require us to incur substantial expenses and change our business. As regulators become increasingly focused on information security, data collection, and privacy, we may be required to devote significant additional resources to dealing with their demands. We experience daily threats to our data and systems. We have experienced cybersecurity incidents in the past, none of which, to date, has resulted in a material impact on our business strategy, results of operations, or financial condition. In 2021, we experienced a cybersecurity incident which is described in this Annual Report under the heading "Item 7 Management's Discussion and Analysis of Financial Condition and Results of Operation – Cybersecurity Incident." Although past events have not resulted in a material impact on our business strategy, results of operations or financial condition, the impacts of cybersecurity incidents in the future could be material. Although we maintain insurance coverage for various cybersecurity risks, there can be no guarantee that we will be fully insured, or that insurance coverage will remain available for cybersecurity risks. Significantly, no amount of effort to deter, identify, mitigate, and/or prevent cybersecurity breaches can achieve 100% success in the current cyber threat environment. Given the financial reward reaped by threat actors for their illegal attacks on technology systems and access to data, and the inability of governments or private industry to fully prevent such attacks and resulting breaches, we expect such attacks to continue. We also expect governments to continue to punish companies that are victims of cyberattacks, whether through statutory fines or otherwise. We cannot provide assurance that we will not experience future cybersecurity incidents or that such incidents will not have a material impact on our business strategy, results of operations, or financial condition. Investors who require any such assurance should not invest in the Company.

The truck rental industry is highly competitive and includes a number of significant national, regional and local competitors, many of which are several times larger than U-Haul. We believe the principal competitive factors in this industry are convenience of rental locations, availability of quality rental moving equipment, breadth of essential services and products and total cost. Financial results for the Company can be adversely impacted by aggressive pricing from our competitors. Some of our competitors may have greater financial resources than we have. We cannot assure you that we will be able to maintain existing rental prices or implement price increases. Moreover, if our competitors reduce prices and we are not able or willing to do so as well, we may lose rental volume, which would likely have a materially adverse effect on our results of operations. Numerous potential competitors are working to establish paradigm shifting technologies from self-driving vehicles to vehicle sharing services and other technologies that connect riders with vehicles. The self-storage industry is large and fragmented. We believe the principal competitive factors in this industry are convenience of storage rental locations, cleanliness, security, and price. Competition in the market areas in which we operate is significant and affects the occupancy levels, rental rates, and operating expenses of our facilities. Competition might cause us to experience a decrease in occupancy levels, limit our ability to raise rental rates, or require us to offer discounted rates that would have a material effect on our results of operations and financial condition. Entry into the self-storage business may be accomplished through the acquisition of existing facilities by persons or institutions with the required initial capital. However, development of new self-storage facilities is more difficult due to land use, zoning, environmental, and other regulatory requirements. The self-storage industry has in the past experienced overbuilding in response to perceived increases in demand. Consolidation of ownership is taking place with certain owners of self-storage. We cannot assure you that we will be able to successfully compete in existing markets or expand into new markets.