\n<\/p>\n
Car rental giant Hertz has begun notifying its customers of a data breach that included their personal information and driver\u2019s licenses.<\/p>\n
The rental company, which also owns the Dollar and Thrifty brands, said in notices on its website<\/a> that the breach relates to a cyberattack on one of its vendors between October 2024 and December 2024. <\/p>\n The stolen data varies by region, but largely includes Hertz customer names, dates of birth, contact information, driver\u2019s licenses, payment card information, and workers\u2019 compensation claims. Hertz said a smaller number of customers had their Social Security numbers taken in the breach, along with other government-issued identification numbers.<\/p>\n Notices on Hertz\u2019s websites disclosed the breach to customers in Australia<\/a>, Canada<\/a>, the European Union<\/a>, New Zealand<\/a>, the United Kingdom<\/a>.\u00a0<\/p>\n Hertz also disclosed the breach with several U.S. states, including California and Maine. Hertz said at least 3,400 customers in Maine were affected, but did not list the total number of affected individuals, which is likely to be significantly higher.<\/p>\n Emily Spencer, a spokesperson for Hertz, would not provide TechCrunch with a specific number of individuals affected by the breach but said it would be \u201cinaccurate to say millions\u201d of customers are affected.<\/p>\n The company attributed the breach to a vendor, Cleo Software, which last year was at the center of a mass-hacking campaign<\/a> by a prolific Russia-linked ransomware gang.<\/p>\n Hertz is one of dozens of companies that used Cleo Software at the time of their data thefts. The Clop ransomware gang claimed last year to have exploited a zero-day vulnerability<\/a> in Cleo\u2019s widely used enterprise file transfer products, which allow companies to share large sets of sensitive data over the internet. By breaching these systems, the hackers stole reams of data from Cleo\u2019s corporate customers.<\/p>\n Soon after, the Clop ransomware gang claimed on its dark web leak site that it stole data from close to 60 companies<\/a> by exploiting the bug in their Cleo systems. In a later post, Clop claimed dozens more alleged corporate victims.<\/p>\n