The Hertz Corporation Data Breach — Class Action Review

The Hertz Corporation stands as one of the most globally recognized leaders in the vehicle rental and transportation services industry. Serving millions of business and leisure travelers annually through its extensive network of airport and neighborhood locations, the company operates at the intersection of mobility, logistics, and consumer finance. To facilitate seamless reservations, vehicle pickups, loyalty program management, and automated toll and citation processing, The Hertz Corporation routinely collects, processes, and stores vast repositories of highly sensitive personal and financial data from its customers, employees, and corporate partners.

In 2025, The Hertz Corporation formally reported a significant data security incident to the California Attorney General, alerting consumers to an unauthorized compromise of its digital infrastructure. While investigations into corporate data breaches of this magnitude frequently point toward sophisticated external intrusions, compromised third-party vendor integrations, or vulnerabilities within cloud-based customer management platforms, the incident underscores the pervasive cyber threats facing major transportation and retail corporations. Malicious actors routinely target organizations in the mobility sector to exploit centralized databases containing high-value consumer profiles and payment infrastructure.

The exposure resulting from this security failure places affected individuals at severe and ongoing risk of identity theft, financial fraud, and targeted phishing campaigns. Because vehicle rental transactions necessitate extensive consumer verification, the compromised datasets typically include full legal names, dates of birth, residential addresses, driver license numbers, major credit and debit card numbers, and associated loyalty account credentials. The unauthorized disclosure of driver license numbers is particularly alarming, as these government-issued identifiers cannot be easily changed and are frequently weaponized by cybercriminals to bypass secondary authentication measures, open fraudulent financial accounts, or perpetrate synthetic identity theft.

As a commercial entity operating within California, The Hertz Corporation had a strict legal obligation under state data protection statutes, including the California Consumer Privacy Act (CCPA) and California's Unfair Competition Law, as well as implied common law duties of care, to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information stored. The occurrence of a data breach of this scale strongly indicates potential vulnerabilities and systemic failures in the company's cybersecurity protocols, encryption standards, and network monitoring defenses, raising serious questions regarding whether adequate safeguards were deployed to protect consumer privacy.

Receiving a formal data breach notification letter from The Hertz Corporation serves as an official acknowledgment that your private information was compromised due to corporate negligence. Under California law, the receipt of such a notification establishes foundational standing to participate in a class action lawsuit aimed at holding the company accountable for failing to safeguard sensitive data. Affected consumers do not need to demonstrate actual financial loss or out-of-pocket theft to seek legal redress; the increased risk of future identity theft and the emotional distress caused by the exposure are legally actionable. Our firm handles these complex data privacy cases on a strict contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.