DISCOVERY DATE: February 2025
THREAT GROUP: Clop Ransomware Gang
VICTIMS: Hertz (Dollar, Thrifty), Western Alliance Bank, WK Kellogg, Thomson Reuters
LENGTH OF BREACH: October – December 2024
INITIAL ENTRY POINT: Cleo Integration Cloud (CIC) zero-day
DATA EXPOSED: Social Security numbers, driver’s licenses, passports, payment data, health info, vehicle claims
PRIMARY OBJECTIVE: Mass identity data theft via 3rd-party access
The Breach They Can’t Contain
More than 100,000 individuals — and potentially far more — had their personal data stolen when cybercriminals exploited a zero-day vulnerability in the Cleo file-sharing platform, used widely by enterprise organizations to move sensitive data between systems.
Among the compromised companies: Hertz, one of the largest vehicle rental conglomerates in the U.S., owning brands like Dollar and Thrifty.
Despite the scale, Hertz has been strategically vague in its disclosure, declining to share nationwide impact totals and simply stating that it would be “inaccurate to say millions” were affected — which, let’s be honest, isn’t a denial.
What Was Stolen?
This wasn’t just some email address leak. The data involved includes:
- Full Social Security Numbers
- Driver’s Licenses
- Government-issued IDs
- Passports
- Payment card info
- Medicare/Medicaid IDs
- Worker’s compensation claim details
- Injury and accident claim records
In other words: every field needed to build, sell, or weaponize a complete digital identity — across medical, financial, and state records.
The Entry Point: Cleo’s Silent Failure
The attack vector was Cleo Integration Cloud (CIC), a cloud-based file transfer system used by hundreds of organizations worldwide. Despite Cleo’s widespread deployment in high-risk sectors like banking, insurance, and logistics, the vulnerability went undetected for at least two months during which threat actors quietly harvested sensitive data without triggering alarms.
This wasn’t just a Hertz issue. Hewlett Packard Enterprise, WK Kellogg, and Thomson Reuters have all admitted being affected or are currently investigating Cleo-related breaches.
And according to breach tracking, the Clop ransomware gang publicly named Hertz as a victim in October 2024, indicating that this may be another case of a corporation withholding breach information for months before regulatory pressure forced a disclosure.
The Bigger Picture: The Third-Party Chain Is the Weak Link
Let’s be clear — this is not just about Hertz. It’s about a larger failure across enterprise cybersecurity. Corporations are outsourcing critical data operations to third-party cloud tools like Cleo, assuming those vendors are secure by default. But when that vendor is compromised, so is everyone downstream.
What we’re seeing is a cascading effect:
- One exploit hits Cleo
- Dozens (maybe hundreds) of corporations leak personal data
- Thousands of lives get disrupted
- Nobody takes responsibility
Cleo didn’t stop it. Hertz didn’t prevent it. The users are left with Kroll identity protection and crossed fingers.
Why This Matters to Every Consumer
If you’ve ever rented a car from Hertz, Dollar, or Thrifty — or submitted a vehicle claim, accident report, or ID verification through their systems — your data may now be circulating in private hacking forums, brokered for fraud, identity theft, or worse.
And here’s the punchline: Hertz says their “network wasn’t affected.”
Technically? Maybe.
Realistically? That’s meaningless.
The breach occurred through trusted infrastructure they depended on to move your most personal data. Whether it was inside their network or just adjacent to it doesn’t change the fact that your info was taken.
Other Companies Impacted by Cleo Exploit
- WK Kellogg – Employee data exfiltrated
- Western Alliance Bank – Over 20,000 identities breached
- Thomson Reuters (Legal Tracker) – Ongoing investigation
- Hewlett Packard Enterprise – Named in Clop leak dump
And this is just what’s confirmed. Dozens of others are likely silent participants in this breach, either because they’re unaware or because disclosure laws haven’t yet caught up with the timeline of exposure.
The Response: Too Little, Too Late
Hertz has:
- Reported the breach to state regulators
- Sent out email/breach notices to victims starting April 11
- Offered two years of free identity monitoring via Kroll
- Shifted blame by saying “many other companies were affected too”
Sound familiar?
This is now the standard breach playbook:
“We weren’t the only ones… The network wasn’t technically touched… We’re offering free protection…”
It’s not accountability. It’s crisis PR.
The Real Threat: Normalization of Leaks
This Hertz breach is another signal that data breaches are no longer exceptional — they’re systemic.
Corporations are stacking third-party tools, often without full security vetting. Once an exploit is discovered, attackers don’t hit one company — they hit everyone using that service.
That means unless these infrastructures are rebuilt with zero-trust models, compartmentalized access, and real breach detection, we’re going to keep seeing the same pattern:
One exploit. Fifty victims. A thousand apologies. Zero change.
Bottom Line:
- If you’ve ever rented from Hertz, Dollar, or Thrifty, assume your data was compromised — even if you haven’t received a letter yet.
- If your business relies on Cleo, re-evaluate immediately.
- Watch out for phishing scams, fake insurance calls, and government impersonation attempts.
And above all else, remember this:
Companies like Hertz may outsource their infrastructure… but you can’t outsource the consequences.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Help us bring real change! Corporate lobbying has corrupted our system for too long, and it’s time to take action. Please sign and share this petition—your support is crucial in restoring accountability to our government. Every signature counts! Thank you!
https://www.ipetitions.com/petition/restore-our-republic-end-lobbying
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
Thank you for this information, John. I’m wondering if anyone won’t be affected to different degrees by these breaches if companies like this continue to act irresponsibly.
You’re welcome, Chris — and you’re absolutely right.
The scary part is that breaches like this are becoming so normalized, most people don’t realize their information’s already in play until it’s too late. And the more companies treat data as a disposable asset, the more we all pay the price — often silently.
This isn’t just about Hertz. It’s about a system that lets third-party tools handle critical info with zero accountability when they fail. If that doesn’t change, then yeah — no one is safe from being affected. The real breach is in trust. And once that’s gone, the damage hits every layer of society.