Hertz says hackers stole customer credit card and driver’s license data

Car rental giant Hertz has issued a warning to its customers regarding a recent data breach that may have compromised sensitive personal information such as credit card details and Social Security numbers. The breach, which occurred through one of the company’s vendors, involved the exploitation of zero-day vulnerabilities within the Cleo Communications file transfer platform between October 2024 and December 2024.

Hertz confirmed the data theft on February 10th and later determined that customers’ personal information, including names, contact details, dates of birth, credit card information, driver’s license details, and workers’ compensation claims data, may have been compromised. Additionally, a small number of individuals had their Social Security numbers, passport numbers, and other government-issued identification data stolen in the breach.

Hertz has reported the incident to law enforcement and relevant regulatory bodies. The company also mentioned that Cleo has since addressed the vulnerabilities that were exploited during the cyberattack.

The website notice regarding the breach is visible in various regions, including the US, Canada, the European Union, the United Kingdom, and Australia. While Hertz has not disclosed the exact number of affected customers, they stated that there have been no reports of fraudulent activity associated with the stolen information.

The group or individual responsible for the cyberattack has not been identified. Cleo, a widely used platform by global organizations, was previously targeted in a mass-hacking campaign last year. The Clop ransomware gang, with ties to Russia, claimed responsibility for the attacks on Cleo and exposed company data on their extortion site.