Hertz Corp. confirmed a threat actor gained access to sensitive personal data in a breach linked to vulnerabilities in Cleo file-transfer software, according to a filing Friday with the Maine Attorney General’s office.
Hertz said it learned on Feb. 10 that an unauthorized third party obtained the data in connection with an attack spree that took place between October and December 2024. Hertz completed an analysis of the stolen data on April 2.
“Importantly, to date, our investigation has found no evidence that Hertz’s own network was affected by this event,” a Hertz spokesperson said via email.
According to the filing, more than 3,400 Maine residents were impacted by the breach. Maine usually discloses the total number of people affected by breaches, but Hertz’s filing discloses only those affected within the state.
Hertz said it has reported the incident to law enforcement and was in the process of notifying relevant regulatory authorities. Hertz is a publicly traded company, but it is not immediately clear whether a filing with the U.S. Securities and Exchange Commission has been made or is necessary.
Companies must disclose within four business days of whether an incident is considered material to financial performance.
The Hertz parent company includes the Hertz, Dollar and Thrifty rental car brands. The company reported $9 billion in revenue in 2024.
Hertz said it was among many companies affected by the attack.
As previously reported, Clop ransomware claimed credit for an attack spree related to vulnerabilities in the file-transfer software.
The company disclosed critical flaws in Cleo Harmony, VLTrader and Lexicon in December. The flaws were tracked as CVE-2024-50623, an unrestricted file upload and download vulnerability, and CVE-2024-55956, which allows an unauthenticated user to import and execute arbitrary bash or PowerShell commands on a host system.
Just last week, breakfast cereal giant WK Kellogg confirmed a breach of employee data was linked to the Cleo vulnerabilities.
Sam’s Club, a unit of Walmart, previously said it was investigating a possible attack after the company name was listed on a Clop leak site.
Hertz was also listed on the Clop leak site, researchers at Huntress confirmed. It is not immediately clear whether Clop made any type of ransom demands against Hertz.
As previously reported, Clop listed dozens of companies on its leak site in connection with the attack spree.
Clop is considered one of the most prolific threat groups in history, as it was behind another massive attack spree in 2023 in connection with vulnerabilities in MOVE-it file-transfer software.
