Hertz, a leading American car rental company, has suffered a substantial data breach impacting customers globally. This breach results from the exploitation of Cleo zero-day vulnerabilities by a ransomware group. These vulnerabilities were exploited in October and December of last year, leading to unauthorized data acquisition confirmed in February of this year. The affected regions include the US, EU, UK, Australia, and Canada.
The exposed data varies but primarily includes names, contact information, dates of birth, driver’s license information, and payment card data. For US customers, additional sensitive data like Social Security numbers, passport details, and Medicare or Medicaid IDs were compromised. Canadian customers also had government identification numbers and injury-related claim details exposed.
Hertz has informed the affected individuals and urged them to be vigilant against fraud. While there is no immediate evidence of data misuse, Hertz has recommended monitoring financial activities closely. To aid in this, Hertz is offering two years of free identity and dark web monitoring services to those impacted.
Given Hertz’s extensive global operations in over 160 countries, the breach carries significant implications. Although the exact number of affected individuals remains undisclosed, the widespread issuance of notices across numerous regions indicates a broad impact. Hertz advises customers to remain alert to potential fraudulent activities and utilize the monitoring services provided. Despite the considerable scope of the breach, Hertz’s primary focus is on minimizing potential fraud and safeguarding customer information.
