The Hertz Corporation, on behalf of Hertz, Dollar, and Thrifty Data Breach — Class Action Review

The Hertz Corporation operates as a premier global vehicle rental leader, managing well-known consumer brands including Hertz, Dollar, and Thrifty. In the course of daily operations, reservations, and loyalty program management, the company collects and maintains vast repositories of sensitive consumer and employee information. Because millions of travelers rely on these services for transportation, the enterprise routinely handles extensive personally identifiable information, payment credentials, and state-issued identification details necessary for vehicle leasing, identity verification, and financial settlement.

In 2025, The Hertz Corporation reported a significant security incident to the Oregon Attorney General, highlighting critical vulnerabilities within its digital infrastructure. While investigations into such corporate breaches typically point toward sophisticated cyberattacks, unauthorized database access, or third-party vendor compromises, incidents of this magnitude frequently expose systemic gaps in network defenses. When enterprise networks are compromised, malicious actors can infiltrate environments designed to store high-value consumer data, bypassing perimeter security controls to harvest confidential records.

The data compromised in this security incident typically encompasses a dangerous combination of full names, driver's license numbers, dates of birth, physical mailing addresses, email addresses, and linked payment card or financial account information. The exposure of travel and identity data creates severe, immediate risks for affected consumers. Driver's license numbers combined with dates of birth and full names provide cybercriminals with the foundational elements necessary to execute sophisticated identity theft, open fraudulent financial accounts, or perpetrate government benefits fraud. Furthermore, compromised payment details expose victims to unauthorized transactions, financial account takeover, and persistent phishing schemes tailored to travel consumers.

Under state consumer protection frameworks and applicable regulations such as the Oregon Consumer Identity Theft Protection Act and Section 5 of the Federal Trade Commission Act, corporate entities like The Hertz Corporation have a strict legal duty to implement and maintain reasonable security measures to protect consumer data. These legal standards require robust encryption, regular vulnerability assessments, and strict access controls. The occurrence of a data breach of this scale strongly indicates a failure to maintain these foundational security protocols, potentially breaching statutory mandates and industry standards for safeguarding confidential information.

Receiving a formal data breach notification letter from The Hertz Corporation serves as official legal acknowledgment that your personal information was compromised due to corporate negligence. Under modern class action jurisprudence, the receipt of such a notification establishes the legal standing necessary to pursue claims against the company for failing to protect sensitive data, even before direct financial fraud manifests. Our law firm is actively investigating potential class action lawsuits on behalf of affected individuals. We handle all data breach cases on a contingency fee basis, meaning you pay nothing out of pocket, and our firm only collects a fee if we successfully recover compensation on your behalf.