Hertz Alerts Customers of Massive Data Breach Including Credit Card and Driver’s License Information

Hertz Discloses Significant Data Breach

Hertz, a major car rental company, has disclosed that an unspecified number of its customers' personal data was stolen in a significant security breach. The compromised information includes names, contact details, dates of birth, credit card information, and driver’s license numbers. Some individuals may also have had their Social Security or government identification numbers, passport information, Medicare or Medicaid IDs, and injury-related information exposed.

Timeline and Scope

The breach occurred through one of Hertz's IT partners, Cleo, via zero-day vulnerabilities in October and December 2024. Hertz became aware of the incident on February 10, 2025, but only completed its data analysis this month. The breach affects customers in the US, Canada, UK, EU, and Australia.

Response and Recommendations

Hertz has informed law enforcement and is notifying relevant regulators. While no instances of fraud have been reported yet, Hertz advises customers to remain vigilant against potential misuse of their information. The company is offering two years of free identity theft monitoring to all affected individuals. Kroll will provide these services at no cost.

Criticism

The timing of the disclosure raises questions, given legal requirements in the EU and US for companies to report data breaches within days of discovery. Critics have noted that Hertz's delayed response is concerning.

Precautionary Measures

Customers are advised to consider freezing their credit as a precaution against identity theft, especially if they do not plan to apply for credit soon.