Existing and future laws or regulations favoring electric, autonomous, and connected vehicles may negatively impact the composition of our fleet and negatively affect our business and results of operations.

Regulatory pressure in connection with the introduction and expansion of electric, autonomous, and connected rental vehicles could require infrastructure improvement that could inhibit our current business model and negatively impact our ability to acquire, or increase our cost of acquisition for rental trucks. Regulatory pressure in connection with the introduction and expansion of electric, autonomous, and connected rental vehicles could both require infrastructure improvement that could inhibit our current business model and negatively impact our ability to acquire, or increase our cost of acquisition for rental trucks. For example, the Advanced Clean Fleets regulation (“ACF”) adopted by the California Air Resources Board (“CARB”) would have required us to phase out certain internal combustion engine vehicles from our fleet and replace them with so-called zero-emission vehicles (“ZEVs”). California must request and receive a waiver from the Environmental Protection Agency (“EPA”) to enforce the ACF, and for now it has withdrawn its request for such a waiver. If California seeks and obtains such a waiver in the future, then to accommodate ZEVs, our Company-operated locations and independent dealer network may require physical upgrades that are uneconomical and/or unachievable. In addition, because many of our vehicles are used by our customers for one-way interstate moves, if the ACF or similar laws or regulations are adopted by federal, state, or provincial governments or regulators in the future, it could materially and negatively affect our operations across North America because our one-way rental vehicles travel throughout the U.S. and Canada. Under any such laws, our one-way rental business would depend, in whole or in part, on an in-transit recharging network throughout the United States and Canada to support electric vehicles or ZEVs. Such a recharging network does not exist today, and even if one is built, the increased rental cost, and time and cost required to charge electric vehicles or ZEVs may be so great as to substantially limit our ability to serve customers needing to move long distances.

We cooperate with original equipment manufacturers (“OEM's"), maintain and train our own technical experts, and operate an equipment Technical Center that has positioned us as an industry leader in innovation for over fifty years. However, any legal or regulatory changes that would require electric, autonomous, or connected vehicles in our fleet would raise challenges of enormous scale. Our repair and maintenance infrastructures, including both physical plants as well as personnel, may be inappropriate for these new types of vehicles. Without such repair and maintenance capabilities it could compromise our ability to operate a fleet of electric vehicles or ZEVs. We may also need to depend upon third party providers for some of those services, and they may not be able to provide workable solutions. There is a risk that we may not be able to adequately prepare for these possibilities. In addition, even if we successfully adapt to any such changes, there can be no guarantee that our fleet or services as adapted would meet the needs of our “do-it-yourself” moving and storage customers, or that we would be able to offer our products and services at prices our customers would be willing or able to pay.

We are encouraged that the U.S. Congress has passed resolutions, subject to signature by President Trump, rescinding waivers granted by the EPA to California for other CARB regulations that would have effectively imposed emissions limits and sales mandates on OEMs well beyond California’s borders. We are also encouraged by the Trump Administration’s actions to reverse and limit state attempts to impose emission and other requirements that would effectively limit the availability of internal combustion vehicles for fleets such as ours. However, there is no assurance that courts or a future Congress or administration will not reverse such rescission of waivers or such actions by the Trump Administration or that California will not apply for and receive a waiver for the ACF. In addition, an existing agreement between OEM’s and California may require OEM’s to meet California’s emissions requirements and sales mandates for electric vehicles or ZEVs even if CARB’s regulations cannot be enforced. If that occurs, we may not be able to successfully adapt to the requirements of a changed regulatory or commercial environment that favors or requires all-electric or specific alternative fuel vehicles.

Any insistence by governments that the future of the economy will be based on all-electric vehicles instead of hybrid or other alternative fuel vehicles may result in government regulators knowingly or unknowingly choosing the winners and losers in an evolving transportation environment. It is possible that they may not choose U-Haul customers and U-Haul to be among the winners. In addition, any such insistence may create an infrastructure in which personal interstate travel would be uneconomical or severely regulated, which could materially and adversely affect our moving business, results of operations, and financial position. In addition, there is growing evidence that consumers may refuse to support an all-electric solution for their moving needs, squeezing U-Haul between government demands and consumer preferences.

We face liability risks associated with the operation of our rental fleet, sales of our products, and operation of our locations.

The operation of our moving and storage centers, our business of renting moving and storage equipment to customers, the sale of moving and storage supplies, towing accessories and installation, and our refilling of propane tanks exposes us to liability claims. These include but are not limited to claims for property damage, personal injury, and even death. We seek to limit the occurrence of such claims through the design of our equipment, communication of its proper use, repair and maintenance schedules, training of our personnel, risk management assessments, and by providing our customers with online resources for the proper use of products and services. Regardless, accidents still occur, and we manage the financial risk of these events through third party insurance carriers. While these excess loss and property insurance policies are available today at affordable costs, this could change and could negatively affect our results of operations and financial position. Changes in attitudes of juries and/or involvement of third parties in the litigation process through litigation financing could negatively affect our results.

Cybersecurity incidents are inevitable and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us. Cybersecurity incidents are inevitable and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us.

We rely on information technology systems to manage and support our operations and provide products, services, and support to our customers. We rely on information technology systems to manage and support our operations and provide products, services, and support to our customers. In connection with these activities, we store and transmit proprietary information and sensitive or confidential data, including personally identifiable information of customers, team members and others. Our reliance on these technology systems and our storage and transmission of such data exposes us to various risks, including cyberattacks or failures in all or part of our technology systems that could result in disruptions in our operations, our ability to serve our customers, or a compromise of our data security. We also face such risks through our use of third-party service providers (including banks, dealers, administrators of our medical insurance plans, and law firms), our communication and filing data with regulatory authorities and government agencies, and our other interactions with third parties, any of whom could be the source of a cyberattack on our technology systems or data.

We commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents. We commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents. We have implemented security protocols, backup systems and alternative procedures to mitigate these risks. We employ IT security team members that have cybersecurity experience or certifications and utilize third-party service providers and consultants to protect our systems and assist us in managing these risks. Our Board and its Audit & Cyber Committee exercise oversight of our cybersecurity risks and management's oversight of the processes and procedures that protect our systems and data. However, despite our security measures, we cannot guarantee that we will not be adversely affected by cybersecurity incidents, including hacks of our systems, denial-of-service attacks, viruses and other malicious software (malware), team member error or malfeasance, phishing attacks, social engineering, security breaches, disruptions during the process of upgrading or replacing computer software or hardware, or other attacks that may jeopardize the security of information stored in or transmitted by technology systems and networks that we or third-party service providers maintain, which include cloud-based networks and data center storage. However, despite our security measures, we cannot guarantee that we will not be adversely affected by cybersecurity incidents, including hacks of our systems, denial-of-service attacks, viruses and other malicious software (malware), team member error or malfeasance, phishing attacks, security breaches, disruptions during the process of upgrading or replacing computer software or hardware, or other attacks that may jeopardize the security of information stored in or transmitted by technology systems and networks that we or third-party service providers maintain, which include cloud-based networks and data center storage.

In addition, our response to cybersecurity incidents, our investments in our technology, and our controls, processes, and practices, may not be sufficient to shield us from significant losses or liability. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasingly sophisticated, including as a result of emerging technologies such as artificial intelligence and machine learning. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, may be difficult to detect, and often are not 9 recognized until launched against a target. Moreover, the techniques used may be difficult to detect, and often are not recognized until launched against a target. As a result, we may not anticipate an attack or respond adequately or timely, and the extent of a particular incident may not be immediately clear. It could take significant time before an investigation can be completed and reliable information about the incident becomes known. During an investigation, it is possible we may not know the extent of the harm, or how to remediate it, which could further adversely impact us. New regulations could result in us being required to disclose information about a cybersecurity incident before it has been fully investigated, mitigated, or resolved. Due to the risk of allegations by plaintiffs’ counsel or government regulators armed with the benefit of hindsight, we may be required to disclose information about a cybersecurity incident even before we determine whether it was material.

In addition, because our systems contain information about individuals and businesses, our failure to maintain the security of the data we hold, whether because of our own error or the malfeasance or errors of others, could lead to unauthorized access or the release of personally identifiable or otherwise confidential or protected information. Our failure to maintain the security of the data we hold could also violate applicable privacy, data security and other laws and subject us to lawsuits and regulatory enforcement resulting in fines. Regulators have been imposing new data privacy and security

requirements, including new and greater monetary fines for privacy violations, such as those under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act. Other U.S. states and Canadian provinces have also proposed or adopted their own data protection legislation or regulations, which are often broad in scope and subject to evolving interpretations and increasing enforcement. Some of these laws and regulations provide for statutory damages or fines even if we have used commercially reasonable efforts to protect our data and systems but a bad actor breaches our cybersecurity defenses and gains access to personally identifiable information. Some of these laws and regulations provide for statutory damages or fines even if the Company has used commercially reasonable efforts to protect its data and systems but a bad actor breaches the Company’s cybersecurity defenses and gains access to personally identifiable information. Even if no party incurs any actual damages, we could be punished by the government for criminal cyberattacks by bad actors, and the fines or other costs imposed upon us could reach amounts that could have a material adverse effect on us, our results of operations, and financial condition. Even if no party incurs any actual damages, the Company could be punished by the government for criminal cyberattacks by bad actors, and the fines or other costs imposed upon us could reach amounts that could have a material adverse effect on the Company, its results of operations, and financial condition. In addition, new and existing data privacy laws and regulations could diverge and conflict with each other in certain respects, making compliance increasingly difficult. Complying with new regulatory requirements could require us to incur substantial expenses and change our business. As regulators become increasingly focused on information security, data collection, and privacy, we may be required to devote significant additional resources to dealing with their demands.

We experience daily threats to our data and systems. We experience daily threats to our data and systems. We have experienced cybersecurity incidents in the past, none of which, to date, has resulted in a material impact on our business strategy, results of operations, or financial condition. In 2021, we experienced a cybersecurity incident which is described in this Annual Report under the heading “Item 7 Management’s Discussion and Analysis of Financial Condition and Results of Operation – Cybersecurity Incident”. Although past events have not resulted in a material impact on our business strategy, results of operations or financial condition, the impacts of cybersecurity incidents in the future could be material. Although we maintain insurance coverage for various cybersecurity risks, there can be no guarantee that we will be fully insured, or that insurance coverage will remain available for cybersecurity risks. Significantly, no amount of effort to deter, identify, mitigate, and/or prevent cybersecurity breaches can achieve 100% success in the current cyber threat environment. Given the financial reward reaped by threat actors for their illegal attacks on technology systems and access to data, and the inability of governments or private industry to fully prevent such attacks and resulting breaches, we expect such attacks to continue. We also expect governments to continue to punish companies that are victims of cyberattacks, whether through statutory fines or otherwise. We cannot provide assurance that we will not experience future cybersecurity incidents or that such incidents will not have a material impact on our business strategy, results of operations, or financial condition. Investors who require any such assurance should not invest in the Company.

We may incur losses due to our reinsurers’ or counterparties’ failure to perform under existing contracts or we may be unable to secure sufficient reinsurance or hedging protection in the future. We may incur losses due to our reinsurers’ or counterparties’ failure to perform under existing contracts or we may be unable to secure sufficient reinsurance or hedging protection in the future.

We use reinsurance and derivative contracts to mitigate our risk of loss in various circumstances. We use reinsurance and derivative contracts to mitigate our risk of loss in various circumstances. These agreements do not release us from our primary obligations and therefore we remain ultimately responsible for these potential costs. We cannot provide assurance that these reinsurers or counterparties will fulfill their obligations. Their inability or unwillingness to make payments to us under the terms of the contracts may have a material adverse effect on our financial condition and results of operations.

As of December 31, 2024, Repwest reported $0.4 million of reinsurance recoverables, net of allowances and $32.4 million of reserves and liabilities ceded to reinsurers. As of the end of fiscal year 2024, Repwest reported $0.4 million of reinsurance recoverables, net of allowances and $36.2 million of reserves and liabilities ceded to reinsurers. Of this, Repwest’s largest exposure to a single reinsurer was $20.3 million.

As of December 31, 2024, Oxford's derivative hedges had a net market value of $8.8 million with notional amounts of $297.1 million.

Risks Related to our Industry

We operate in a highly competitive industry.

The truck rental industry is highly competitive and includes a number of significant national, regional and local competitors, many of which are several times larger than U-Haul. The truck rental industry is highly competitive and includes a number of significant national, regional and local competitors, many of which are several times larger than U-Haul. We believe the principal competitive factors in this industry are convenience of rental locations, availability of quality rental moving equipment, breadth of essential services and products and total cost. Our financial results can be adversely impacted by aggressive pricing from our competitors. Financial results for the Company can be adversely impacted by aggressive pricing from our competitors. Some of our competitors may have greater financial resources than we have. We cannot assure you that we will be able to maintain existing rental prices or implement price increases. Moreover, if our competitors reduce prices and we are not able or willing to do so as well, we may lose rental volume, which would likely have a materially adverse effect on our results of operations.

The self-storage industry is large and fragmented. We believe the principal competitive factors in this industry are convenience of storage rental locations, cleanliness, security, and price. Competition in the market areas in which we operate is significant and affects the occupancy levels, rental rates, and operating expenses of our facilities. Competition

might cause us to experience a decrease in occupancy levels, limit our ability to raise rental rates, or require us to offer discounted rates that would have a material effect on our results of operations and financial condition. Entry into the self-storage business may be accomplished through the acquisition of existing facilities by persons or institutions with the required initial capital. However, development of new self-storage facilities is more difficult due to land use, zoning, environmental, and other regulatory requirements. The self-storage industry has in the past experienced overbuilding in response to perceived increases in demand. Consolidation of ownership is taking place with certain owners of self-storage. We cannot assure you that we will be able to successfully compete in existing markets or expand into new markets.

In addition, the moving and storage industry has experienced rapid changes in technology. Numerous potential competitors are working to establish paradigm shifting technologies from self-driving vehicles to vehicle sharing services and other technologies that connect riders with vehicles. Additionally, customer demand for ease of online or app-based management of their moving and storage transactions continues to grow. Customers also increasingly turn to new technologies, such as artificial intelligence apps and chatbots to locate and compare products, including moving and storage products, and we may not successfully adapt our marketing and ability to reach customers through these new and developing platforms. There may be other innovations and technologies that could impact the do-it-yourself moving and storage industries that we cannot yet foresee. We actively develop and deploy new technologies, but we cannot ensure that our initiatives will be successful or timely, and our failure to effectively implement any initiative could have an adverse impact on our financial condition or results of operations.

Economic conditions, including those related to the credit markets, interest rates and inflation, may adversely affect our industry, business and results of operations. Economic conditions, including those related to the credit markets, interest rates and inflation, may adversely affect our industry, business and results of operations.

Consumer and commercial spending are generally affected by the health of the economy, which places some of the factors affecting the success of our business beyond our control. Consumer and commercial spending are generally affected by the health of the economy, which places some of the factors affecting the success of our business beyond our control. Our businesses, although traditionally not as cyclical as some, could experience significant downturns in connection with or in anticipation of declines in general economic conditions. In times of declining consumer spending, we may be driven to reduce pricing, which could have a negative impact on gross profit. In addition, any downturn in the economy could result in reduced revenues and working capital. Trends in the economy are resulting in inflationary pressures leading to an increase in our cost of doing business. Tariffs and trade restrictions could be announced with little or no advance notice that could adversely affect us. We cannot guarantee that we would be able to either manage the costs lower or pass them along to our customers in the form of higher prices. We cannot guarantee that we can manage the costs lower or pass them along in the form of higher prices to our customers.

Should credit markets in the United States tighten or if interest rates increase significantly, we may not be able to refinance existing debt or find additional financing on favorable terms, if at all. Should credit markets in the United States tighten or if interest rates increase significantly, we may not be able to refinance existing debt or find additional financing on favorable terms, if at all. If one or more of the financial institutions that support our existing credit facilities fails or opts not to continue to lend to us, we may not be able to find a replacement, which would negatively impact our ability to borrow under credit facilities. If our operating results were to worsen significantly and our cash flows or capital resources prove inadequate, or if interest rates increase significantly, we could face liquidity problems that could materially and adversely affect our results of operations and financial condition.

A.M. Best financial strength ratings are crucial to our life insurance business.

In September 2024, A.M. Best affirmed the financial strength rating (“FSR”) for Oxford and Christian Fidelity Life Insurance Company (“CFLIC”) of A. The FSR outlook was revised to negative from stable. The FSR outlook remains stable. In addition, A.M. Best affirmed the long-term issuer credit rating (“LTICR”) of “a”. The LTICR outlook of these ratings was revised to negative from stable. The LTICR outlook of these ratings is stable. Financial strength ratings are important external factors that can affect the success of Oxford’s business plans. Accordingly, if Oxford’s ratings, relative to its competitors, are not maintained or do not continue to improve, Oxford may not be able to retain and attract business as currently planned, which could adversely affect our results of operations and financial condition.

Risks Related to our Financings

We are leveraged.

As of March 31, 2025, we had total debt outstanding of $7,229.3 million and operating lease liabilities of $47.0 million. As of March 31, 2024, we had total debt outstanding of $6,304.0 million and operating lease liabilities of $55.0 million. Although we believe, based on existing information, that additional leverage can be supported by our operations and revenues, our existing debt could impact us in the following ways, among others:

Our ability to make payments on our debt and leases depends upon our ability to maintain and improve our operating performance and generate cash flow. Our ability to make payments on our debt and leases depends upon our ability to maintain and improve our operating performance and generate cash flow. To some extent, this is subject to prevailing economic and competitive conditions and to certain financial, business and other factors, some of which are beyond our control. If we are unable to generate sufficient cash flow from operations to service our debt and meet our other cash needs, including our leases, we may be forced to reduce or delay capital expenditures, sell assets, seek additional capital or restructure or refinance our indebtedness and leases. If we must sell our assets, it may negatively affect our ability to generate revenue. In addition, we may incur additional debt or leases that would exacerbate the risks associated with our indebtedness.

Risks Related to our Organization

A majority of our Voting Common Stock is owned by a small contingent of stockholders.

Willow Grove Holdings LP, directly and through controlled entities (“WGHLP”), owns 9,791,911 shares of our common stock, $0.25 par value per share (“Voting Common Stock”), and together with Edward J. Willow Grove Holdings LP, directly and through controlled entities (“WGHLP”), owns 9,791,911 shares of our common stock, $0.25 par value per share (“Voting Common Stock”), and together with Edward J. Shoen and Mark V. Shoen, owns 9,828,541 shares (approximately 50.1%) of Voting Common Stock. The general partner of WGHLP controls the voting and disposition decisions with respect to the Voting Common Stock owned by WGHLP, and is managed by Edward J. Shoen (the Chairman of the Board of Directors and Chief Executive Officer of U-Haul Holding Company) and his brother, Mark V. Shoen. Accordingly, Edward J. Shoen and Mark V. Shoen are in a position to significantly influence our business and policies, including the approval of certain significant transactions, the election of the members of our board of directors (the “Board”) and other matters submitted to our stockholders. There can be no assurance that their interests will not conflict with the interests of our other stockholders.

Furthermore, we are a “controlled company” within the meaning of the New York Stock Exchange corporate governance standards. Furthermore, we are a “controlled company” within the meaning of the New York Stock Exchange corporate governance standards. Under these corporate governance standards, a company of which more than 50% of the voting power for the election of directors is held by an individual, group or another company is a “controlled company” and may elect not to comply with certain corporate governance standards, including the requirements (1) that a majority of our Board consist of independent directors, (2) that our Board have a compensation committee that consists entirely of independent directors with a written charter addressing the committee’s purpose and responsibilities, and (3) that our director nominations be made, or recommended to our full Board, by our independent directors or by a nominations committee that consists entirely of independent directors and that we adopt a written charter or board resolution addressing the nomination process.

As described in this Annual Report, we rely upon our “controlled company” status to permit our full Board to nominate directors rather than delegate that responsibility to the independent directors or a nominations committee comprised of independent directors. For that reason, our Board has not created a nominating committee. In the future we may rely upon our status as a “controlled company” to not comply with other governance standards. For example, we may decide not to have a Board that consists of a majority of independent directors or a compensation committee that consists entirely of independent directors with a written charter addressing its purposes and responsibilities.

In addition, 732,866 shares (approximately 4.0% of our Voting Common Stock) are owned under our ESOP. Each ESOP participant is entitled to vote the shares allocated to himself or herself in their discretion. If an ESOP participant does not vote his or her shares, those shares will be voted by the ESOP trustee, in the ESOP trustee’s discretion.

The trading price for our outstanding Voting Common Stock and Series N Non-Voting Common Stock may be volatile.

The trading prices of our Voting Common Stock and Non-Voting Common Stock and the allocation of value between the two has previously been, and may be volatile and their respective values may decline. The trading prices of our Voting Common Stock and Non-Voting Common Stock and the allocation of value between the two has previously been, and may be volatile and their respective values may decline. In addition, the trading prices of our two series of common stock may fluctuate widely in response to various factors, some of which are beyond our control. These factors include, among others:

Risks Related to Legal, Regulatory and Compliance

Our operations subject us to numerous environmental laws and regulations and the possibility that environmental liability in the future could adversely affect our operations.

Compliance with environmental requirements of federal, state, provincial and local governments in the United States and Canada affects our business. Compliance with environmental requirements of federal, state, provincial and local governments in the United States and Canada affects our business. Among other things, these requirements regulate the discharge of materials into the air, land and water and govern the use and disposal of hazardous substances. Under environmental laws or common law principles, we can be held liable for hazardous substances that are found on real property we have owned or operated. We are aware of issues regarding hazardous substances on some of our real estate and we have put in place a remediation plan at each site where we believe such a plan is necessary. See Note 19, Contingencies, of the Notes to Consolidated Financial Statements. We regularly make capital and operating expenditures to stay in compliance with environmental laws. In particular, we have managed a testing and removal program since 1988 for our underground storage tanks. Despite these compliance efforts, the risk of environmental liability is part of the nature of our business.

Environmental laws and regulations are complex, change frequently and could become more stringent in the future. Environmental laws and regulations are complex, change frequently and could become more stringent in the future. We cannot assure you that future compliance with these laws and regulations, future environmental liabilities, the cost of defending environmental claims, conducting any environmental remediation or generally resolving liabilities caused by us or related third parties will not have a material adverse effect on our business, financial condition or results of operations.

We are highly regulated and changes in existing laws and regulations or violations of existing or future laws and regulations could have a material adverse effect on our operations and profitability. We operate in a highly regulated industry and changes in existing laws and regulations or violations of existing or future laws and regulations could have a material adverse effect on our operations and profitability.

Our truck, trailer, self-storage, and U-Box container rental business is subject to regulation by various federal, state and provincial governmental entities in the United States and Canada. Our truck, trailer, self-storage, and U-Box rental business is subject to regulation by various federal, state and provincial governmental entities in the United States and Canada. For example, the U.S. Department of Transportation and various state, federal and Canadian agencies exercise broad powers over our motor carrier operations, safety, and the generation, handling, storage, treatment and disposal of waste materials. In addition, our business is also subject to federal, state, provincial and local laws and regulations relating to environmental protection, land use, and human health and safety, among other matters. In addition, our storage business is also subject to federal, state, provincial and local laws and regulations relating to environmental protection and human health and safety, among other matters. The failure to comply with any of these laws and regulations may adversely affect our ability to sell or rent our equipment or property or to use our property as collateral for future borrowings. The failure to comply with these laws and regulations may adversely affect our ability to sell or rent such property or to use the property as collateral for future borrowings. In addition, zoning choices enacted by individual municipalities in the United States and Canada may limit our ability to serve certain markets with our products and services. Zoning choices enacted by individual municipalities in the United States and Canada may limit our ability to serve certain markets with our products and services. Compliance with changing laws and regulations could substantially impair real property and equipment productivity and increase our costs. Compliance with changing laws and regulations could substantially impair real property and equipment productivity and increase our costs.

In addition, we may become subject to federal, state, or provincial regulations that set a maximum amount of carbon emissions individual entities can emit without penalty or we may become subject to carbon-based taxes. Such regulations or taxes would likely affect everyone who uses fossil fuels and would disproportionately affect users in the highway transportation industries. This would likely affect everyone who uses fossil fuels and would disproportionately affect users in the highway transportation industries.

We have no evidence to support a belief that “do-it-yourself” moving customers are willing to accept any additional costs that could result from such penalties or taxes. Should such penalties or taxes be enacted, we could see an increase in expenses, including compliance costs and a negative effect on our operating margin. Should such a tax be enacted, we could see an increase in expenses, including compliance costs and a negative effect on our operating margin.

As our U-Box operations increasingly provide services to customers for moves to countries other than the United States and Canada, we may also be exposed to laws and regulations in those other countries. The need to comply with any such laws or regulations could increase expenses.

Our insurance companies are heavily regulated by state insurance departments and the National Association of Insurance Commissioners. Our insurance companies are heavily regulated by state insurance departments and the National Association of Insurance Commissioners. These insurance regulations are primarily in place to protect the interests of our policyholders

and not our investors. Any new laws or regulations applicable to our insurance companies or any changes in existing laws and regulations could increase our costs, inhibit new sales, or limit our ability to implement rate increases.

Potential risks related to our protection of our intellectual property.

Since 1945, we have used certain trade dress, such as our distinctive orange U-Haul trucks, trailers, U-Boxes, and orange door self-storage units and trademarks that include the color orange to distinguish our brand, products, and services. We believe that our rights in our intellectual property, including our rights to use the color orange in the promotion of our goods and services, are strong and well-supported. However, over the past few years, Public Storage has sought to prevent self-storage operators from using the color orange in connection with their self-storage services. We filed a lawsuit against Public Storage in the District of Arizona in December 2024, asking for a declaration that our trade dress and trademarks that use orange do not infringe on Public Storage's claimed intellectual property rights. While we believe we will be able to successfully protect our rights to continue to use the color orange to distinguish our brand, products and services, there can be no assurance of a favorable outcome. If we are unsuccessful, our ability to use these marks could be limited, which could adversely impact our financial condition or results of operations.

Changes to U.S. tax laws may adversely affect our financial condition or results of operations and create the risk that we may need to adjust our accounting for these changes.

The Tax Cuts and Jobs Act (“Tax Reform Act”) and the Coronavirus Aid, Relief and Economic Security Act (“CARES Act”) made significant changes to U.S. tax laws and include numerous provisions that affect businesses, including ours. For instance, as a result of lower corporate tax rates, the Tax Reform Act tends to reduce both the value of deferred tax assets and the amount of deferred tax liabilities. It also limits interest expense deductions and the amount of net operating losses that can be used each year and alters the expensing of capital expenditures. Other provisions have international tax consequences for businesses like ours that operate internationally. The CARES Act allows for the carryback of certain net operating losses. The Tax Reform Act is unclear in certain respects and will require interpretations and implementing regulations by the Internal Revenue Service (“IRS”), as well as state tax authorities, and the Tax Reform Act and CARES Act could be subject to amendments and technical corrections, any of which could lessen or increase the adverse (and positive) impacts of these acts. The Tax Reform Act put into place 100% first year bonus depreciation. This decreased to 80% starting in 2023, 60% in 2024, 40% in 2025, and will continue to gradually decrease in future years and will impact our tax liability. This decreased to 80% starting in 2023, 60% in 2024 and will continue to gradually decrease in future years and will impact our tax liability. The accounting treatment of these tax law changes was complex, and some of the changes affected both current and future periods. Others primarily affected future periods. Additional changes to the U.S. tax code could negatively offset operating cashflows.

Changes to tax policy, corporate tax rates or interpretations of existing tax law could change our effective tax rate, reduce future expected tax deductions and increase current and future federal income tax payments. Changes to tax policy, corporate tax rates or interpretations of existing tax law could change our effective tax rate, reduce future expected tax deductions and increase current and future federal income tax payments.

General Risk Factors

Terrorist attacks could negatively impact our operations and profitability and may expose us to liability and reputational damage.

Terrorist attacks may negatively affect our operations and profitability. Terrorist attacks may negatively affect our operations and profitability. Such attacks may damage our facilities and it is also possible that our rental equipment could be involved in a terrorist attack. Although we carry excess of loss insurance coverage, it may prove to be insufficient to cover us for acts of terror using our rental equipment. Moreover, we may suffer reputational damage that could arise from a terrorist attack which utilizes our rental equipment. The consequences of any terrorist attacks or hostilities are unpredictable and difficult to quantify. We seek to minimize these risks through our operational processes and procedures; however, we may not be able to foresee events that could have an adverse effect on our operations.

Item 1B. Unresolved Staff Comments

None.

Item 1C. Cybersecurity

Cybersecurity incidents are inevitable in the current threat environment. We believe that it is a question of “when” not “if” a cybersecurity incident will occur. As a result, we commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents, including the amount of information that can be extracted from our systems by threat actors, whether internal or external.

We take a cross-departmental approach to addressing cybersecurity risk, which includes input from senior management, our Cybersecurity Council (a taskforce comprised of representatives from primary corporate functions across our Moving and Storage, Property and Casualty Insurance, and Life Insurance subsidiaries), other team members, and oversight by the Board and its Audit & Cyber Committee. We commit resources to cybersecurity and risk management processes to

analyze the changing cybersecurity landscape and respond to ongoing and emerging threats. We monitor and assess the threat landscape on an ongoing basis. Our Cybersecurity Council reviews cybersecurity risks. In addition, we have a set of Company-wide policies and procedures that directly or indirectly relate to cybersecurity. These policies go through an internal review process and are approved by members of management.

The Company’s Director, Data Privacy & Security leads the IT security team and is responsible for coordinating and implementing our information security program. The Director, Data Privacy and Security also reports on cybersecurity matters to senior management and informs on such matters to the Audit & Cyber Committee of the Board. IT security team members have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we perform simulations and tabletop exercises with members of the Cybersecurity Council and other team members involved in incident response. We involve external resources and advisors as needed. Team members have on-demand online access to cybersecurity training through our online U-Haul University.

We have expanded investments in IT security and improved access control and identity and authentication management, and engage consultants as needed. We test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party consultants. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, mitigation, and remediation. The cybersecurity team collects data on cybersecurity threats and risk areas and conducts risk assessments. We conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of our third-party service providers. Our assessment of risks associated with our use of third-party service providers is part of our overall cybersecurity risk management framework.

The Audit & Cyber Committee and the full Board participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit & Cyber Committee reviews the Company’s cybersecurity program, which includes discussion of management’s actions to identify and detect threats, recent enhancements to the Company’s defenses, and management’s progress on its cybersecurity initiatives. In addition, the Board and the Audit & Cyber Committee discuss recent threats and how the Company is managing those threats.

Despite our work to identify and address cybersecurity risks, we experience threats to our data and systems. We have experienced cybersecurity incidents in the past, including breaches of our data and systems. To date, none of those cybersecurity incidents has resulted in a material impact on our business strategy, results of operations or financial condition. However, the impacts of cybersecurity incidents in the future could be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents are inevitable, and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us" in Item 1A- Risk Factors in this Annual Report.