Hertz

Disclosed Apr 11, 20251,222,756 affectedConfirmed

Cleo zero-day breach exposes Hertz customers' licenses and card data

Hertz, which also owns Dollar and Thrifty, said customer data was stolen in an October to December 2024 attack on vendor Cleo, including driver's licenses, payment card data and workers' compensation claims; 96,665 Texans were affected.

What is known

People affected	1,222,756 (as reported by the organization)
Disclosed	Apr 11, 2025
Discovered	Feb 10, 2025
Happened	Oct 27, 2024
Attack	Supply chain
Data exposed	NamesGovernment IDsHealthInsuranceCredentials and tokensDates of birthPhone numbersEmailsPayment cardsSocial Security numbers
Sector	Transport · US
Status	Confirmed
Part of	Cleo (2024)

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Hertz

Official noticeatg.wa.gov

Washington Attorney General breach notice: Hertz

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: Hertz

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Hertz

Newstechcrunch.com

Hertz says customers' personal data and driver's licenses stolen in data breach

Newsbleepingcomputer.com

Hertz confirms customer info, drivers' licenses stolen in data breach

Official noticeago.vermont.gov

Vermont Attorney General: 2025-04-11 The Hertz Corporation, on behalf of Hertz, Dollar, and Thrifty Data Breach Notice to Consumers

Official noticein.gov

Indiana Attorney General 2025 data breach report: Hertz

Notices filed

Residents of CAApr 11, 2025

California AGCount not stated

Residents of WAApr 11, 2025

Washington AG19,297 people

Residents of DEApr 11, 2025

Delaware DOJ3,118 people

Residents of ORApr 11, 2025

Oregon DOJ1,000,175 people

Residents of VTApr 11, 2025

Vermont AGCount not stated

Residents of INApr 11, 2025

Indiana AG12,307 people

TotalApr 14, 2025

ResearchCount not stated

Same campaign

WK KelloggSupply chain exposed names, Social Security numbers and employment records. Reported to the Indiana AG.Supply chain4,093 affectedManufacturingUSApr 4, 2025

Sam's ClubClop lists Sam's Club on leak site; retailer investigatesExtortionRetailUSUnverifiedMar 28, 2025

Western Alliance BankCleo zero-day breach exposes 21,899 Western Alliance Bank customersSupply chain22K affectedFinanceUSMar 14, 2025

History of this record

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdfby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/document/2025-04-11-hertz-corporation-behalf-hertz-dollar-and-thrifty-data-breach-notice-consumersby backfillSource

campaign2026-09-25

empty to cleo-2024by seedSource

sector2026-09-25

other to transportby seedSource

attack2026-09-25

hacking to supply-chainby seedSource

data_types2026-09-25

["names","government-id","health","insurance","credentials"] to ["names","government-id","health","insurance","credentials","dob","phone","emails","payment-card","ssn"]by seedSource

summary2026-09-25

empty to Hertz, which also owns Dollar and Thrifty, said customer data was stolen in an October to December 2024 attack on vendor Cleo, including driver's licenses, payment card data and workers' compensation claims; 96,665 Texans were affected.by seedSource

title2026-09-25

empty to Cleo zero-day breach exposes Hertz customers' licenses and card databy seedSource

occurred2026-09-25

empty to 2024-10-27by backfillSource

data_types2026-09-25

[] to ["names","government-id","health","insurance","credentials"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 1222756by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2025-02-10by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Hertz