Hertz Confirms Major Data Breach Affecting Thousands: Credit Cards, Driver’s Licenses, and More at Risk
A new and alarming data breach involving Hertz, Thrifty, and Dollar rental car brands has left thousands of customers in at least three U.S. states vulnerable to potential identity theft and financial fraud. Cybercriminals exploited a zero-day vulnerability in Cleo file transfer software late last year, exposing a trove of personally identifiable information (PII) that includes names, dates of birth, driver’s license numbers, credit card details, and even possible health-related records.
Rental Car Customers in Multiple States Hit
So far, data breach notifications have been sent to impacted customers in Maine, California, and Vermont—with over 3,400 individuals confirmed compromised in Maine alone. Hertz has not disclosed the total number of affected renters nationwide, raising concerns that the real scope of the breach could be significantly larger.
What Hackers Stole
The Clop cybercriminal group responsible for these attacks is known for targeting major corporations. In this case, the stolen data may include:
-
Full names and contact information
-
Credit card numbers and expiration dates
-
Driver’s license data
-
Dates of birth
-
Worker’s compensation claim details
-
Possibly Social Security numbers and passport info
Not all customers had the same type of data exposed, but even partial details are enough to enable identity theft or targeted phishing scams.
Why This Breach Is So Concerning
This incident is especially troubling because Hertz is a household name that processes sensitive data on a massive scale, including payment and ID information for car rentals. With criminals already claiming responsibility, concerned customers must stay alert for fraudulent activities such as unauthorized credit card transactions, suspicious account logins, and highly personalized phishing messages.
Hertz Responds with Free Identity Protection
To help customers safeguard their identities, Hertz is offering two years of free identity theft protection through Kroll, a service with an A- rating from the Better Business Bureau. Affected individuals are encouraged to enroll as soon as possible:
-
Check Your Mailbox: Notifications will include instructions and a code to sign up.
-
Contact Hertz for Details: If you suspect you are affected but haven’t received a notice, call Hertz or refer to the company’s official data breach resources.
-
Use the Kroll Identity Theft Protection: This service includes credit monitoring and up to $1 million in identity theft insurance.
Steps to Protect Yourself Immediately
Even if you haven’t received a notification, taking these actions can substantially lower your risk:
-
Freeze Your Credit
Placing a credit freeze at the three major bureaus (Equifax, Experian, and TransUnion) helps prevent unauthorized loans or accounts in your name. -
Be Wary of Phishing Attempts
Hackers often leverage stolen data to craft deceptive emails, messages, or phone calls. Double-check links before clicking, and never share passwords or personal information when in doubt. -
Secure Your Devices
Install one of the best antivirus software solutions to protect against spyware, keyloggers, and other malware. Look for extra security features such as a VPN and password manager. -
Monitor Financial Statements
Keep a close eye on bank and credit card activity. Report suspicious charges or unauthorized withdrawals immediately. -
Update Login Credentials
Change passwords on your most sensitive accounts, and enable two-factor authentication where possible.
A Sobering Reminder
This breach underscores that even trusted companies can fall victim to sophisticated cyberattacks. With criminals actively seeking new targets, staying on guard is critical. If you’re a Hertz, Thrifty, or Dollar customer, don’t wait for fraud to occur—take advantage of the free identity theft protection and implement these best practices now. Your vigilance could be the only line of defense against damaging financial loss or identity theft.
Photo Credit: DepositPhotos.com