Overview

• Hertz has confirmed that customer data, including credit card details, driver’s license information, and other personal identifiers, was stolen in a breach exploiting Cleo Software vulnerabilities in late 2024.
• The breach, linked to the Clop ransomware gang, affected customers across multiple regions, including the US, Canada, UK, EU, Australia, and New Zealand.
• Hertz began notifying affected customers on April 14, 2025, and is offering two years of free identity monitoring services as a precautionary measure.
• The company reports no evidence of its internal networks being compromised or any misuse of the stolen data for fraudulent purposes so far.
• Hertz has reported the incident to law enforcement and regulators, while Cleo Software has since addressed the exploited vulnerabilities.