EXPLORINEER
en

Archive — US — techcrunch

Hertz says customers’ personal data and driver’s licenses stolen in data breach

Hertz has notified customers about a data breach exposing personal information, including driver's licenses, due to a cyberattack on its vendor, Cleo Software, from October to December 2024. Although affected data varies, it includes names, contact info, payment details, and potentially Social Security numbers. Hertz reported that thousands may be impacted, notably in Maine, attributing the attack to a ransomware gang exploiting vulnerabilities in Cleo's software.

Key points

  • Hertz announced a data breach affecting personal and payment information of customers due to a cyberattack on vendor Cleo Software.
  • The breach occurred between October and December 2024, primarily affecting regions including Australia, Canada, the EU, New Zealand, and the UK.
  • Data stolen includes names, dates of birth, contact info, driver's licenses, and payment card information, with a smaller fraction involving Social Security numbers.
  • Approximately 3,400 customers in Maine were confirmed affected, but the total number is likely higher.
  • Cleo Software faced a mass-hacking campaign by the Russia-linked Clop ransomware gang, which exploited vulnerabilities in Cleo's system to access multiple companies' data.
  • Despite being named as victims of the breach, Hertz claimed earlier there was no evidence of its own systems being compromised, but acknowledges third-party data was stolen.

Why it matters

  • The data breach reflects ongoing cybersecurity issues affecting numerous enterprises, especially those relying on third-party vendors.
  • Cleo Software's involvement highlights the increased scrutiny surrounding supply chain security in the IT sector, particularly post-mass-hacks.
  • The incident connects to the growing trend of zero-day vulnerabilities exploitation, as seen in multiple 2025 IT developments.

The Hertz data breach underscores the significant risk posed by third-party vendors in cybersecurity, highlighting the necessity for enterprises to enhance their security protocols and monitoring strategies.