Hertz Confirms Customer and Employee Data Taken Through Cleo Flaw

Hertz confirmed in April 2025 that data belonging to customers and employees had been exfiltrated through the Cleo file-transfer vulnerabilities, in unauthorised access reported to have occurred in two waves, in October and December 2024.

The company completed its internal investigation on 2 April 2025. The interval between the first wave and that conclusion is around six months.

The company did not hold the compromised product. A supplier’s software was exploited, data belonging to the company was taken from it, and establishing whose records were in the extracted files is work that has to be done record by record.

This corpus has recorded that shape repeatedly — at 25-0210, where nearly three million people were notified the year after the event, and across the supplier-compromise files. The delay is structural, and treating it as negligence obscures where the actual failure sat.

The routes into the public record set out at 25-0502 and extended at 25-0924b include a securities listing, and this is a clean instance. A privately held car rental operator using the same product would have had the same exposure and, quite possibly, produced no public record at all.

That is the observation the corpus keeps making and it should be uncomfortable each time: the incidents this database contains are disproportionately the incidents that happened to companies with an obligation to say so.

How many people were affected. Reporting at the time described categories of data rather than counts, and this desk has not seen a figure it would print.

The corpus writes "Not established" in a case card rather than guessing, and this file carries several. A file that reported a number here would be reporting an estimate somebody else made.