Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
In a statement confirming the incident, the firm said customer data was “acquired by an unauthorized party that we understand exploited zero-day vulnerabilities within Cleo's platform in October 2024 and December 2024”.
“Hertz immediately began analyzing the data to determine the scope of the event and to identify individuals whose personal information may have been impacted,” the statement added.
Customer data exposed in the breach may vary, the company said, but is believed to include customer names, contact information, dates of birth, credit card details, and information pertaining to driver’s licenses.
Similarly, a limited number of customers may have had US social security numbers or government ID information stolen in the breach.
"A very small number of individuals may have had their Social Security or other government identification numbers, passport information, Medicare or Medicaid ID (associated with workers' compensation claims), or injury-related information associated with vehicle accident claims impacted by the event," the company warned.
Hertz said it is yet to observe any “misuse of personal information” linked to the breach, but is offering customers two years of identity monitoring services. The company also advised customers to remain vigilant for potential fraudulent activity.
Hertz the latest to disclose Cleo vulnerability impact
Hertz’ confirmation makes it the latest in a string of companies to have fallen victim to the Cleo breach. First disclosed last year, a vulnerability in the popular managed file transfer (MFT) service was pounced on by the Clop ransomware group.
The threat group initially claimed it had stolen data belonging to more than 60 companies as a result of the zero-day. This list has since grown, and earlier this year Western Alliance Bank confirmed it was among the growing list of victims.
Other confirmed victims include Chicago Public Schools, Champion Home Builders, and WK Kellogg.
Fresh research from ReliaQuest shows the impact of the Cleo breach will continue to grow for enterprises globally. Indeed, analysis by the security firm found the incident fueled a 23% increase in overall ransomware activity between Q4 and Q1 2025.
“Clop’s exploitation of Cleo highlights how weaknesses in systems can ripple across interconnected industries, disrupting supply chains, halting operations, and impacting countless businesses simultaneously,” the firm said in a blog post.
Rebecca Moody, head of data research at Comparitech, echoed this warning, noting that there’s likely to be “many more breach notifications from this exploit” as Clop has since added over 350 victims to its data leak site.
Dray Agha, senior manager of security operations at Huntress, said the incident underlines the “significant risks” posed by vulnerabilities in third-party platforms like Cleo.
“This highlights the importance of maintaining robust vulnerability management programs to identify and address security gaps in software promptly, especially those used for sensitive data transfer.”
Agha added the incident reflects a growing trend of cyber criminals targeting secure file transfer platforms. 2023, for example, saw a number of high-profile organizations impacted by the MOVEit data breach.
MORE FROM ITPRO
- The new ransomware groups worrying security researchers in 2025
- The ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry
- Warning issued over prolific 'Ghost' ransomware group
-
European financial firms are battling a huge rise in third-party breachesNews Growing vendor dependency has contributed to a marked rise in third-party breaches
-
‘We’ve got some fabulous conditions’: Salesforce UK chief exec Zahra Bahrololoumi touts the country's tech industry potentialNews The UK remains a “priority market” for Salesforce, according to its regional CEO
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabsNews An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operatorsNews A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attackNews A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
