I love having non tech companies in charge of PII and financial data that is not easily changed

not the first time, apparently
https://www.bleepingcomputer.com/news/security/u-haul-discloses-data-breach-exposing-customer-driver-licenses (2022)