Hertz data breach: Cleo file-transfer flaw exposed Hertz, Dollar and Thrifty customers, up to 1,222,756 people

What happened in the Hertz data breach?

Hertz uses Cleo's platform to move files for limited purposes. On February 10, 2025, Hertz confirmed that its data had been acquired by a third party exploiting zero-day vulnerabilities in that platform. Hertz then analyzed the data to find whose information was in it, and finished on April 2, 2025. It says Cleo investigated and fixed the vulnerabilities, and that Hertz reported the event to law enforcement and regulators.

Date	What happened	Source
October 2024	First exploitation of Cleo's platform; Oregon's breach date is October 27, 2024	Hertz notice; Oregon list
December 2024	Second exploitation	Hertz notice
February 10, 2025	Hertz confirms its data was taken	Hertz notice; Oregon list
April 2, 2025	Data analysis finished	Hertz notice
April 11, 2025	Notice; report to Oregon (1,000,175)	Oregon list

Notice came 166 days after the breach date on Oregon's record and 60 days after Hertz confirmed the theft. The notice-delay guide compares that with other notices.

How many people were affected by the Hertz data breach?

Between 1,000,175 and 1,222,756, depending on which state's record you read. Both list the same notice, sent on April 11, 2025 for a breach dated October 27, 2024, under the name The Hertz Corporation on behalf of Hertz, Dollar and Thrifty. Indiana's 2025 report records 1,222,756 people in total and 12,307 Indiana residents. Indiana's figure is the tenth-largest total in its 2025 report, the place Hertz holds in the largest data breaches of 2025. Oregon's list records 1,000,175. Hertz's own notice gives no number, and nothing fetched here explains the 222,581 difference.

Record	What it counts	Number
Indiana attorney general, 2025 report	People affected in total	1,222,756
Indiana attorney general, 2025 report	Indiana residents	12,307
Oregon Department of Justice	People affected in total	1,000,175

Indiana's figure was the tenth-largest total in its 2025 report.

Washington's attorney general lists a notice from The Hertz Corporation reported on April 11, 2025, with 19,297 Washingtonians affected. Its record names names, Social Security numbers, driver's license or state ID numbers, full dates of birth, military ID numbers, passport numbers, health insurance policy or ID numbers and other information as the information compromised. The figure counts Washington residents only.

What information was exposed?

For most people: name, contact information, date of birth, credit card information, driver's license information, and information related to workers' compensation claims. For a very small number, Social Security or other government ID numbers, passport information, Medicare or Medicaid IDs tied to workers' compensation claims, or injury information from vehicle accident claims. Hertz says it is not aware of any fraudulent misuse.

Why was Hertz affected by a Cleo vulnerability?

Because Hertz's files passed through the vendor's platform, which Hertz says it used for limited purposes. The guide to vendor breach notices compares how such notices are worded, and the guide to why you got a breach letter from a company you never dealt with covers the reverse case.

Which Cleo vulnerabilities were exploited?

Hertz's notice does not give CVE numbers. It says the third party exploited zero-day flaws in Cleo's platform in October 2024 and December 2024. CISA's Known Exploited Vulnerabilities catalog, checked on November 12, 2026, lists two Cleo flaws added that December. Both affect Cleo Harmony, VLTrader and LexiCom, and both are marked as known to be used in ransomware campaigns.

CVE	CISA's name for it	Added to the catalog	Ransomware use
CVE-2024-50623	Cleo Multiple Products Unrestricted File Upload Vulnerability	December 13, 2024	Known
CVE-2024-55956	Cleo Multiple Products Unauthenticated File Upload Vulnerability	December 17, 2024	Known

CISA describes both as file upload flaws in managed file transfer products that let an attacker run code. The catalog does not name victims, so it cannot say which flaw was used against Hertz's files. What it shows is timing: the government recorded both flaws as exploited in December 2024, the same month as the second wave Hertz describes.

What is Hertz offering?

Two years of identity monitoring or dark web monitoring from Kroll, at no cost. The United States notice gives a Kroll sign-up link. Questions go to (866) 408-8964, Monday to Friday, 6:00 a.m. to 8:00 p.m. Central Time, excluding major U.S. holidays. The guide to credit monitoring offers explains what a free credit freeze adds.

What the record leaves open

• Who exploited the Cleo flaws; the notice does not name a group.
• How many of the people notified had a Social Security or passport number involved.
• Whether the October and December exploitation took the same files.