🚨 Hertz confirms a data breach triggered by a Cleo zero-day — and the fallout includes highly sensitive personal data.
Attackers exploited a previously unknown vulnerability in Cleo Communications' file transfer software, accessing customer information across Hertz, Thrifty, and Dollar rental brands.
Data compromised includes:
- Names, contact details, dates of birth
- Credit card info, driver’s license numbers
- Social Security numbers, passport data, and injury records tied to vehicle incidents
The Clop ransomware group claimed responsibility — continuing its trend of supply chain-focused exploits. The breach occurred in October and December 2024 and was publicly disclosed in February 2025.
🔍 Experts are calling this a textbook example of third-party risk:
- “A driver’s license or SSN can’t be reset like a password,” said Ensar Seker, CISO at SOCRadar
- James Neilson at OPSWAT emphasized the need for proactive patching and vendor risk monitoring
Hertz is offering two years of identity protection to affected customers, but the long-term risk of identity fraud remains high.
🧠 At @Efani we’ve seen this pattern again and again:
A zero-day in a little-known vendor becomes a front door for data theft, and consumers bear the brunt.
When digital identity is permanent, companies must move from passive defense to resilience by design — especially when third-party tools are in play.
#CyberSecurity #DataBreach #SupplyChainSecurity #EfaniSecure #ZeroDayExploit