Hertz says hackers stole customer credit card and driver’s license data

Car rental giant Hertz is alerting customers that personal information including credit card details and Social Security numbers may have been stolen in a data breach that impacted one of the firm’s vendors. In a notice posted to its website, Hertz says that company data “was acquired by an unauthorized third-party” during a cyberattack exploiting zero-day vulnerabilities within the Cleo Communications file transfer platform between October 2024 and December 2024.

The data theft was confirmed by Hertz on February 10th, with further analysis on April 2nd concluding that customers’ names, contact information, dates of birth, credit card information, driver’s license details, and information related to workers’ compensation claims may have been exposed by the breach. Hertz also says that “a very small number of individuals” had their Social Security numbers taken in the breach, along with passport numbers and other government-issued identification data.

Hertz says that the incident is being reported to law enforcement and relevant regulators, and that Cleo has since addressed “the identified vulnerabilities.”

The website notice is viewable across multiple regions, including the US, Canada, the European …read more