Hertz Hackers Obtained Customers' Personal Information and License Records | Carscoops

      Hertz has reported that it experienced a cyberattack between October and December 2024.

      During this incident, some drivers’ social security numbers, along with their names and payment details, were compromised.

      The company attributes its exposure to vulnerabilities in software from Cleo, the provider of its file transfer system.

      Each year, Hertz rents out its cars and vans millions of times, gathering sensitive information from numerous customers in the U.S. and worldwide. Recently, Hertz announced that some of this personal data was accessed in a cyberattack last fall.

      In a statement on its website, Hertz indicated that hackers exploited zero-day vulnerabilities in software supplied by Cleo Communications, a U.S.-based firm. Cleo's file transfer platform is designed to allow companies like Hertz to handle large amounts of customer data securely, but in February, Hertz learned that driver data had been stolen in October and December of the previous year.

      Hertz claims that the stolen data may include names, contact details, dates of birth, driver's license information, and payment card data. It also acknowledged that some renters might have had their social security numbers and Medicare or Medicaid IDs accessed, as well as passport information.

      The rental company has not specified the total number of customers affected by the breach but told TechCrunch that it would be "inaccurate to say millions." However, they acknowledged that at least 3,400 customers in Maine were impacted, with additional customers in other states, including California, according to TechCrunch.

      Furthermore, the presence of customer alert notices on various Hertz websites globally suggests that the breach extends beyond the U.S., affecting customers in the UK, the European Union, Australia, Canada, and New Zealand.

      Hertz has informed law enforcement about the incident and is notifying regulators. While it has not detected any misuse of customer information, the company has enlisted the services of cyberattack experts Kroll to offer two years of identity monitoring services at no cost to potentially affected individuals.

      This incident is not the first involving Cleo's file transfer technology; last year, a ransomware group with ties to Russia targeted Cleo's systems used by multiple companies.