Hertz Confirms Data Breach After Cleo Zero-Day Attack by Clop Ransomware Gang

Customers of Hertz, Thrifty, and Dollar Affected by File Transfer Platform Attack

Car rental giant Hertz Corporation has confirmed a data breach after attackers exploited zero-day vulnerabilities in the Cleo managed file transfer platform, resulting in the theft of sensitive customer information for users of its Hertz, Thrifty, and Dollar rental brands.

The breach, attributed to the Clop ransomware gang, was part of a larger mass exploitation campaign that affected dozens of companies in late 2024.

Incident Timeline and Affected Systems

According to a breach notification issued by Hertz:

“On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day vulnerabilities within Cleo’s platform in October 2024 and December 2024.”

The exploited vulnerabilities targeted Cleo Harmony, VLTrader, and LexiCom — secure file transfer products used by large enterprises to handle sensitive information.

What Data Was Stolen?

Hertz says the type of stolen data varies by individual, but may include:

• Full names

• Contact details

• Dates of birth

• Credit card information

• Driver’s license numbers

• Workers’ compensation claim data

A “very small number” of victims may also have had:

• Social Security numbers

• Government-issued ID numbers

• Passport info

• Medicare/Medicaid IDs

• Injury-related data tied to accident claims