Hertz says customers’ personal data and driver’s licenses stolen in data breach

Hertz disclosed that customer data was acquired by an unauthorized third party after attackers exploited zero-day vulnerabilities in vendor Cleo’s enterprise file-transfer products between October and December 2024; the breach—linked to the Clop ransomware/extortion campaign—exposed PII including driver’s licenses, payment card data, and some Social Security numbers and affected customers across multiple countries and U.S. states.