Car Rental & Grocery-Restaurant · Car Rental (also owns Dollar, Thrifty) · Structural / no discrete incident
Hertz
Headline
Hertz's 2024-25 exposure came through a third-party vendor, and rental car data is more revealing than the transaction suggests: a rental record ties a named person to a specific vehicle in a specific place on specific…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Hertz's 2024-25 exposure came through a third-party vendor, and rental car data is more revealing than the transaction suggests: a rental record ties a named person to a specific vehicle in a specific place on specific dates, and modern rental fleets are connected, generating telematics. Rental agreements also routinely capture a driver's licence scan and, for international renters, passport details. Cross-ref the Allstate/Arity finding in the Insurance tab for what happens to vehicle movement data once it leaves the vehicle.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected; note that plaintiffs' firms (e.g., Morgan & Morgan) have publicized a PARALLEL mass-arbitration track for this breach in addition to the formal class actions.
Data sharing
CONFIRMED THIRD-PARTY VENDOR BREACH (2024-2025): Hertz confirmed customer data (across its Hertz, Dollar, and Thrifty brands) was accessed by an unauthorized third party that exploited ZERO-DAY VULNERABILITIES in a file-transfer platform run by Cleo Communications, a vendor Hertz used to move data between its own systems and third parties, during October and December 2024. Exposed data included names, DRIVER'S LICENSE NUMBERS, credit card information, and — notably — details related to WORKERS' COMPENSATION CLAIMS (an employee-adjacent data category, not typically found in a rental-car customer breach). Hertz reportedly began notifying affected customers around April 2025, after reportedly confirming in February 2025 that its data had been compromised (dates not confirmed against Hertz's own notice this pass) — potentially the same 'delayed disclosure' pattern flagged for several other companies in this tracker (Sony/PSN, Marriott).
Fees and billing
Multiple class actions (lead case Jiwani v. Cleo Communications U.S., LLC and Hertz, N.D. Ill., filed April 15, 2025, plus ten similar complaints transferred to the same court) alleging negligence, breach of implied contract, and unjust enrichment — Hertz's Q2 2026 Form 10-Q states the plaintiffs and Cleo conditionally settled all claims against all defendants at a June 30, 2026 mediation; settlement terms/amount and court approval were not confirmed in this review (Oct 2026). (The March 12, 2026 settlement in principle disclosed in Hertz filings relates to a separate securities class action, not the breach.)
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (HTZ). Service route: c/o General Counsel / Corporate Secretary, Estero, Florida — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy hertz.com/rentacar/global/en_US/privacyPolicy | Not fetched yet | NO (HTML only) |
| Terms of service hertz.com/rentacar/global/en_US/termsAndConditions | Not fetched yet | NO (HTML only) |
| Website hertz.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Florida. Provisions of FDBR on file:
| Provision | Type | Source |
|---|---|---|
| Applicability — Narrowest of Any State; $1B Revenue + Specific Activities Fla. Stat. § 501.702 | threshold | source |
| Enforcement — Highest Per-Violation Penalties; Trebled for Minor Violations Fla. Stat. § 501.72 | hard | source |