Hertz 2024 Data Breach
The 2024 Hertz data breach was a third-party incident caused by exploitation of zero-day vulnerabilities in a Cleo file-transfer platform that Hertz used for limited purposes.
Exposed Data Types
1 sensitive12- Medicare/Medicaid IDs
- Names
- Contact information
- Dates of birth
- Driver's licenses
- Credit card information
- Workers' compensation claims
- Social security numbers
- Government-issued IDs
- Passport information
- Injury information
- Email addresses
About This Breach
Hertz confirmed that an unauthorized party acquired company data through Cleo in October and December 2024.
Because the exact first-access day was not disclosed, the catalog uses October 2024 month precision. Hertz confirmed the acquisition on February 10, 2025, and completed its review on April 2.
What information was affected?
The information varies by individual. Hertz says it may include names, contact details, dates of birth, driver's-license information, credit-card information, and workers' compensation claim details.
A smaller group may have had Social security numbers or other government identifiers involved. A very small number may also have had passport information, Medicare or Medicaid IDs, or injury information associated with vehicle-accident claims affected. The incident involved customers of the Hertz, Dollar, and Thrifty brands.
How many people were affected?
Hertz has not disclosed a global unique affected-person total. The 3,409 people reported to Maine represent notification recipients in that state only and are not used as the overall count.
How did Hertz respond?
The company stopped using the affected Cleo service, notified law enforcement and relevant regulators, and offered affected people two years of identity-monitoring services. Hertz says it found no evidence that its own network was affected.
What should affected people do?
Notice recipients should monitor payment cards and financial accounts, review credit reports, and report unfamiliar activity promptly. People whose driver's-license or identity-document information was involved should follow the country-specific steps in their notice.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
