Hertz, the well-known car rental company, has notified customers of a data breach affecting one of its vendors that may have led to the theft of personal information, including credit card details and Social Security numbers. Hertz’s online notice reveals that company data was accessed by an unauthorized third-party during a cyberattack exploiting zero-day vulnerabilities in the Cleo Communications file transfer platform between October and December 2024.
The breach, confirmed by Hertz on February 10th, was further analyzed on April 2nd. Findings indicated that the compromised data might include customers’ names, contact information, birth dates, credit card details, driver’s license information, and data related to workers’ compensation claims. Additionally, it was discovered that “a very small number of individuals” had their Social Security numbers, passport numbers, and other government-issued IDs compromised.
Hertz has reported the incident to law enforcement and relevant regulatory bodies. Cleo has since resolved “the identified vulnerabilities.” The notice can be accessed in various regions, such as the US, Canada, the EU, the UK, and Australia. Despite not disclosing the number of affected customers, Hertz stated that there has been no evidence of fraudulent misuse of personal information tied to the incident. Further clarification from Hertz on the number of impacted customers has been sought.
The cyberattack’s perpetrators remain unidentified. Cleo, utilized by numerous international organizations, was a target of a significant hacking campaign in October last year. The Russia-linked Clop ransomware group later took responsibility, releasing Cleo’s data on its extortion site and claiming to have breached 59 organizations through vulnerabilities in Cleo’s platform.
