The Hertz Corporation obo Hertz Dollar and Thrifty Data Breach — Class Action Review

The Hertz Corporation, operating on behalf of its prominent consumer vehicle rental brands including Hertz, Dollar, and Thrifty, functions as a massive global leader in the transportation and mobility services sector. Serving millions of business and leisure travelers annually, the enterprise manages vast fleets of vehicles across thousands of corporate and franchise locations worldwide. To facilitate seamless vehicle reservations, counter rentals, loyalty programs, and payment processing, the company routinely collects and stores deeply sensitive consumer and employee information. This includes government-issued identification details, major credit card numbers, driver license numbers, dates of birth, contact particulars, and comprehensive travel histories, all of which are essential for identity verification and fraud prevention during high-volume commercial transactions.

In 2025, The Hertz Corporation reported a significant security incident to the Indiana Attorney General, raising urgent concerns among customers and legal advocates regarding the safety of corporate digital infrastructure. While investigations into such large-scale transportation and retail breaches frequently center on sophisticated cyberattacks, unauthorized network incursions, or vulnerabilities within third-party vendor platforms, the core issue remains a potential breakdown in enterprise cybersecurity defenses. Incidents of this nature typically expose the weak points in centralized reservation databases and customer relationship management systems, allowing malicious actors to infiltrate environments where millions of consumer profiles are aggregated.

The exposure resulting from this incident encompasses a dangerous array of personally identifiable information and financial records, heightening the risk of severe downstream consumer harm. Unauthorized access to driver license numbers, full legal names, dates of birth, and primary payment card details leaves victims immediately vulnerable to targeted phishing scams, unauthorized credit card charges, and sophisticated financial account takeovers. Furthermore, when high-value data such as driver credentials and contact details are compromised simultaneously, victims face a long-term risk of synthetic identity theft, where bad actors open fraudulent loans, utility accounts, or government benefits using the stolen credentials, creating profound financial and administrative burdens for years to come.

As a major commercial entity handling sensitive consumer payment and identification data, The Hertz Corporation was legally obligated to maintain robust, industry-standard administrative, physical, and technical safeguards. Under state consumer protection statutes, the Indiana Deceptive Consumer Sales Act, and overarching federal guidelines enforced by the Federal Trade Commission, companies are required to implement continuous network monitoring, encryption, and rigorous vendor risk management to prevent unauthorized access. The 2025 data breach represents a prima facie failure of these foundational legal duties, indicating that the corporation's security posture was inadequate to withstand modern cyber threats or to properly isolate its most critical data assets.

For consumers who received an official data breach notification letter from The Hertz Corporation, this document serves as formal legal confirmation that their private information was compromised due to corporate negligence. Legally, the receipt of this notice establishes the necessary standing to participate in a class action lawsuit aimed at holding the company accountable for its failure to protect sensitive data. Affected individuals are reminded that they do not need to demonstrate actual financial loss or identity theft to seek legal recourse; the increased risk of future harm and the time spent monitoring accounts are actionable injuries in themselves. Our firm investigates these matters on a strict contingency fee basis, meaning clients pay absolutely nothing out of pocket unless we successfully recover compensation on their behalf.