Table of contents
- A cyberattack hits Hertz: what really happened
- Hertz’s response: is it enough to rebuild trust?
- How to protect yourself after the Hertz data breach
- Not just Hertz: the wave of data breaches continues
A cyberattack hits Hertz: what really happened
Between October and December 2024, a major data breach affected Cleo Communications, a third-party provider handling data transfers for Hertz, the world’s largest car rental company. The cybercriminals exploited a zero-day vulnerability, gaining access to a massive trove of customer data.
The stolen information includes full names, birth dates, contact details, driver’s license numbers, credit card details, and in some cases even health card and passport numbers.
On Feb. 10, 2025, Hertz confirmed that an unauthorized third party exploited a zero-day vulnerability in Cleo’s system to carry out the theft.
Hertz’s response: is it enough to rebuild trust?
After the attack, Hertz brought in Kroll, a company specialized in cyber security consulting, to offer two years of dark web monitoring to affected users.
The company also notified law enforcement and data protection authorities, urging customers to monitor their accounts for suspicious charges.
However, the phone support set up by Hertz is a UK number with English-only assistance, making it difficult for non-English-speaking users to get help.
How to protect yourself after the Hertz data breach
If you’ve rented a car with Hertz recently, it’s crucial to activate SMS alerts for your credit or debit cards to track all payments in real time.
Review your bank statements regularly. If you notice any unauthorized charges, block the card immediately and notify your bank. By law, your liability is limited to €50 if the card is blocked promptly.
Watch out for scam calls and phishing emails posing as legitimate requests: never share sensitive information over the phone or via email.
Not just Hertz: the wave of data breaches continues
This attack is part of a worrying trend that has recently hit companies like Infocert, Eprice, and the ATM app. The Hertz case, however, is especially alarming because it involves both personal and financial data, making customers vulnerable to immediate fraud.
This incident highlights the urgent need to secure personal information and demand clear communication from companies that manage it.
