Hertz data breach exposed customers’ personal information, lawsuits claim

Hertz data breach class action overview:

• Who: Consumers filed three class action lawsuits against Hertz and Cleo Communications.
• Why: The Hertz data breach lawsuits claim Hertz and Cleo failed to protect customer data in a ransomware attack.
• Where: The class action lawsuits were filed in Illinois and Florida federal courts.

Car rental company Hertz and its cloud-based data management host Cleo have been hit with three new class action lawsuits alleging they failed to protect customers’ personal information in a ransomware attack.

The plaintiffs filed the lawsuits in Illinois and Florida federal courts, claiming their personal information was compromised in a data breach of Cleo’s network from October to December 2024.

Hertz uses a third-party file transfer system managed by Cleo and knew the severity of the breach but delayed disclosing it publicly, the lawsuits allege.

The company did not announce the security incident had occurred until April 2, according to the lawsuits.

“Plaintiff and Class Members now face ongoing and substantial risks of identity theft, fraud and other misuse of their private information,” lead plaintiff Muneerah Crawford says.

The Florida Hertz data breach class action lawsuit names only Hertz as a defendant, while the other two suits, both filed in Illinois federal court, also name Cleo as a defendant.

Hertz data breach left customers’ personal information vulnerable, plaintiffs say

One of the class action lawsuits claims Hertz and Cleo maintained customers’ personal information in a “reckless manner.”

The information was unencrypted in their systems and vulnerable to cyberattacks, the complaint alleges.

CLOP, a well-known ransomware group, orchestrated the breach in October 2024 and left a ransom note on Hertz’s website threatening to release the data if the ransom was not paid, according to one of the Hertz data breach class action lawsuits.

Hertz has not disclosed whether it paid the ransom, plaintiffs say.

The lawsuits seek certification of a nationwide class of affected Hertz customers, an award of damages, attorney fees and costs and injunctive relief that would force Hertz and Cleo to more securely store sensitive customer data.

In 2024, car rental company Avis disclosed it suffered a data breach that affected nearly 300,000 of its customers. Avis said it discovered on Aug. 5 that an unauthorized party had gained access to one of its business applications. 

What do you think of the Hertz data breach class action lawsuits? Join the discussion in the comments.

The plaintiffs are represented by Joshua H. Eggnatz and Michael J. Pascucci of Eggnatz Pascucci; Melissa R. Emert and Gary S. Graifman of Kantrowitz Goldhamer & Graifman P.C.; A. Brooke Murphy of Murphy Law Firm; Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC; and Marc H. Edelson and Liberato P. Verderame of Edelson Lechtzin LLP.

The Hertz data breach class action lawsuits are Crawford v. Hertz Global Holdings Inc., Case No. 2:25-cv-00323, in the U.S. District Court for the Middle District of Florida; Zelson v. Communications US LLC, et al., Case No. 1:25-cv-04245; and Jonte v. The Hertz Corporation, et al., Case No. 3:25-cv-50178, both in the U.S. District Court for the Northern District of Illinois, Western Division.

Read About More Class Action Lawsuits & Class Action Settlements:

• Nuna car seat class action lawsuit alleges dangerous harness defect
• Nespresso class action claims Vertuo Next coffee machines are defective
• Tom’s of Maine class action alleges toothpaste is contaminated with mold, bacteria
• Massive drug safety recall includes generic Advil, Tylenol, Motrin, Zyrtec, Onglyza, and dozens more