Cleo Flaw Leads to Significant Hertz Data Breach

Hertz has confirmed that customer data has been stolen during a cyberattack on Cleo Communications, a third-party vendor providing file transfer services. The company said the breach occurred when “zero-day vulnerabilities within Cleo’s platform” were exploited in October and December 2024 — an attack it attributes to an “unauthorized third party.”

The stolen information varies by region, but primarily includes customer names, dates of birth, contact details, driver’s license numbers, payment card information, and in some cases, Social Security numbers or other government-issued IDs. Hertz said “a smaller number of customers had their Social Security numbers taken,” alongside records of “workers’ compensation claims.”

The breach spans several regions, with notices posted for customers in the US, EU, UK, Canada, Australia, and New Zealand. In regulatory filings, the company revealed at least 96,665 Texans and 3,400 Mainers were affected, though it has not disclosed the full number impacted by the breach. When asked by TechCrunch, a spokesperson said it would be “inaccurate to say millions” of customers were impacted.

The Clop ransomware gang, which last year targeted vulnerabilities in Cleo’s platform, has claimed to have breached dozens of companies using its software. At the time, Hertz was listed among the victims on Clop’s leak site, though it initially stated there was “no evidence” of its data being affected. That position shifted as the company confirmed that its data “was acquired by an unauthorized third party.”

In another attack, Clop stole over 1 million patient records, showing the broad scope and aggressive tactics of the group.

Hertz said in a statement to Reuters that “our forensic investigation has found no evidence that Hertz’s own network was affected by this event,” and emphasized that it is not aware of any incidents where the breached personal information has been misused.

Cleo has not responded to inquiries regarding the breach. Hertz said it has disabled access to its data via Cleo and that it will enhance oversight of its third-party vendors moving forward.