HackingRetail & ConsumerTransportation & LogisticsRetailVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedMulti-Stage ChainGovernment IDFinancial accountHealth (basic)Identity (basic)CriticalContained

THE HERTZ CORPORATION

bd_4d9936b8024bb49a · schema v1 · pii pii-v1

Severity

Critical

Discovered

Oct 1, 2024

Filed

Jun 24, 2024

To disclose

—

Affected · nationwide

1,613,7736,647 in this filing

Confidence

65%

Full breach record for THE HERTZ CORPORATION →3 incidents on file

Hertz Corporation notified Delaware AG of a supply-chain breach involving vendor Cleo Communications US, LLC. An unauthorized third party exploited zero-day vulnerabilities in Cleo's file transfer platform in Oct/Dec 2024 to exfiltrate data. Hertz confirmed the scope on April 2, 2025. Over 1.6 million individuals affected, including 6,647 Delaware residents. Data included SSNs, driver's licenses, financial account numbers, and medical history. Hertz engaged Kroll for identity monitoring and reported to law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jun 24, 2024

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,613,773 affectedView incident

Name: Landmark Admin, LLC.
norm: landmark admin

Name: THE HERTZ CORPORATION
norm: the hertz
Industry: Retail & ConsumerllmTransportation & Logisticsllm

Discovered: Oct 1, 2024
Breach occurred: Oct 1, 2024 – Dec 31, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 2, 2025
Affected individuals: 1,613,773state + nationwide
Data types: Government IDFinancial accountHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported event to law enforcementIn the process of reporting the event to relevant regulators
Third party: via Cleo Communications US, LLC
Initial access: exploit_public_facing

During the incident: Confirmed Cleo took steps to investigate the event and address identified vulnerabilities
Reported this event to law enforcement
In the process of reporting the event to relevant regulators
Secured the services of Kroll to provide two years of identity monitoring services
Changes made: Cleo addressed identified vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2025/04/Hertz.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2024
Raw hash: 95c1a38756be7abdbec85bf3825b30d78dc34e4fa364c750a35550d1aee01900

Reporting entityLandmark Admin, LLC.

Victim entityTHE HERTZ CORPORATION

Incidentdiscovered Oct 1, 2024

Stated responseConfirmed Cleo took steps to investigate the event and address identified vulnerabilities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov