Latest / Tech Talks With Kinsoft / Hertz 2025 Data breach

Transcript

Hertz 2025 Data breach · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. This is where
• 0:02
  we unpack the stories shaping our digital world
• 0:04
  and hopefully help you navigate the tricky bits
• 0:06
  of tech and security. Today, we're looking at
• 0:09
  a really critical cybersecurity incident, one
• 0:12
  that goes way beyond just a single company, actually.
• 0:15
  It's the recent Hertz data breach. And unfortunately,
• 0:19
  it's hit customers right here in Australia, too.
• 0:22
  Yeah. And our goal today isn't just to rehash
• 0:24
  the headlines. We want to get into not just what
• 0:27
  happened, but really why it matters, particularly
• 0:29
  this whole area of third party vendor security,
• 0:33
  which often flies under the radar. This whole
• 0:35
  event, it's definitely concerning, but it's also
• 0:37
  a serious wake up call, you know, for people,
• 0:40
  for businesses. It shows just how connected everything
• 0:42
  is and maybe more vulnerable than we think. Absolutely.
• 0:45
  And what I find really interesting here is how
• 0:47
  a huge company like Hertz, you'd assume they
• 0:49
  have pretty solid security, right? But they got
• 0:52
  compromised, not through their own front door,
• 0:54
  so to speak, but through a weakness in a vendor
• 0:57
  they were using for apparently limited purposes.
• 0:59
  It's like locking your house, but forgetting
• 1:01
  the side gate used by the gardener. That's a
• 1:03
  great analogy. OK, let's unpack this properly
• 1:05
  then. So the basics first. Hertz has started
• 1:08
  telling customers their data was involved. And
• 1:10
  Hertz Australia specifically confirmed, yes.
• 1:13
  Australians are affected. So this isn't just
• 1:15
  some overseas story. It's local. Right. And the
• 1:18
  way it happened is, well, it's a classic supply
• 1:21
  chain attack, really. It wasn't Hertz's own systems
• 1:23
  that failed. It came from an incident at a third
• 1:26
  party, a company called Clio. They provide a
• 1:29
  file sharing platform that Hertz used, the attackers,
• 1:33
  the Klopp cyber extortion group. They basically
• 1:35
  found and used what we call zero day vulnerabilities.
• 1:40
  Okay, zero -day vulnerabilities. That sounds
• 1:42
  pretty bad. Can you quickly break that down?
• 1:45
  What does zero -day actually mean? Sure. Think
• 1:47
  of it like finding a secret flaw, a hidden weakness,
• 1:50
  in a piece of software that the makers, the vendor,
• 1:52
  don't even know about yet. So they have literally
• 1:55
  zero days to fix it before the bad guys find
• 1:58
  it and start using it. In this case, Klopp found
• 2:00
  these weak spots in Clio's system before Clio
• 2:02
  could patch them. That gave the attackers basically
• 2:05
  a free pass in. Specifically, we know they used
• 2:08
  two flaws identified as CVE -2024 -50623 and
• 2:13
  CVE -2024 -55956. CVEs. Right. Those are the
• 2:18
  standard ID codes for vulnerability. Exactly.
• 2:21
  Common vulnerabilities and exposures. And these
• 2:23
  weren't small bugs. They were serious enough
• 2:25
  to let attackers get around security. It looks
• 2:27
  like this happened in... sort of two waves, October
• 2:30
  2024 and then again in December 2024. That timeline
• 2:34
  is quite something, especially the gap between
• 2:36
  things happening and people finding out. Hertz
• 2:39
  confirmed they knew data was taken on February
• 2:40
  10th, 2025. But the investigation to figure out
• 2:44
  who was affected wasn't done until April 2nd.
• 2:46
  And then they started telling customers on April
• 2:47
  11th. But what's really striking is you said
• 2:50
  Klopp exploited this back in December 2024. And
• 2:53
  Hertz was apparently listed on Klopp's Darknet
• 2:55
  site then, December 24th. That's right. Listed
• 2:58
  on the leak site then. And the data itself seems
• 3:00
  to have been published about a month later, January
• 3:02
  24th, 2025. Wow. So the criminals had the data,
• 3:07
  even released it way before customers got the
• 3:09
  official word. That lag is definitely something
• 3:12
  individuals worry about. And it's important to
• 3:14
  know this wasn't just the main Hertz brand. It
• 3:17
  also affected customers of Dollar and Thrifty,
• 3:19
  which are, you know. part of the Hertz group.
• 3:21
  Right. So if you've rented from any of those
• 3:23
  three, especially here in Australia, you need
• 3:25
  to pay attention. Definitely. So the big question
• 3:28
  for everyone listening, what data actually got
• 3:31
  out? For Australians, we're talking name, contact
• 3:33
  details, date of birth, driver's license info,
• 3:36
  and crucially, payment card information. Yeah,
• 3:39
  that's the core PII, personally identifiable
• 3:43
  information. Hertz did say only a very small
• 3:46
  number also had passport details exposed. But
• 3:48
  still, that's really sensitive stuff. Extremely.
• 3:51
  And just to show the scale for U .S. customers,
• 3:53
  it even included things like Social Security
• 3:55
  numbers and workers comp info. That's a massive
• 3:58
  haul of personal data. It really is. But what's
• 4:01
  fascinating, technically speaking, is what Hertz
• 4:04
  has stressed. Their own investigation found no
• 4:08
  sign that Hertz's internal network was breached.
• 4:11
  It purely came through that third party, through
• 4:13
  Clio, which just hammers home the point about
• 4:16
  vendor risk. You can have the best locks on your
• 4:19
  own doors, but if your supplier leaves their
• 4:21
  door open. Then you're exposed anyway. Yeah.
• 4:23
  So what's Hertz doing about it? Apart from notifying
• 4:25
  people, obviously. Well, they've confirmed Clio,
• 4:28
  the vendor, took steps to investigate and fix
• 4:30
  those vulnerabilities. That's step one. Hertz
• 4:33
  also reported it to law enforcement and they're
• 4:35
  notifying the relevant regulators, which they
• 4:37
  have to do. Standard procedure. And importantly
• 4:40
  for those affected, as a precaution, Hertz is
• 4:43
  offering two years of free identity monitoring
• 4:45
  via Kroll. Ah, Kroll. They're a well -known name
• 4:49
  in this space. What does that monitoring typically
• 4:51
  involve? Yeah, it generally includes a few key
• 4:54
  things. Credit monitoring, so you get alerts
• 4:56
  if someone tries to open credit in your name.
• 4:59
  Identity restoration assistance, which is huge.
• 5:02
  Yeah. If the worst happens, they help you clean
• 5:04
  up the mess. And dark web surveillance. Meaning
• 5:07
  they scan those dodgy marketplaces to see if
• 5:09
  your details pop up. Exactly. They look for your
• 5:11
  stolen info being sold or traded. Hertz says
• 5:15
  they're not aware of any misuse of the data so
• 5:17
  far, but they're still urging everyone to be
• 5:20
  vigilant. Which is always good advice anyway,
• 5:22
  right? These things can take time to surface.
• 5:25
  Absolutely. Fraudsters might sit on data for
• 5:27
  months or even years. So let's connect this to
• 5:29
  the bigger picture. You mentioned supply chain
• 5:31
  risks and third -party vendor vulnerabilities.
• 5:35
  This Hertz case seems like exhibit A for that.
• 5:38
  It really is. It perfectly shows how even a company
• 5:41
  with presumably strong internal security can
• 5:45
  get tripped up by a partner. It forces a rethink
• 5:48
  of security, doesn't it? Yeah. It's not just
• 5:50
  about your own perimeter anymore. It's about
• 5:52
  this whole ecosystem of trust. And the trust
• 5:54
  needs constant checking, I suppose. Continuous
• 5:57
  verification, yeah. Companies often underestimate
• 6:00
  just how wide the damage can spread from one
• 6:03
  single compromised vendor. Like you said, Hertz's
• 6:06
  own systems weren't the entry point. It was Clio's
• 6:09
  weakness that Klopp exploited. It's like those
• 6:12
  Russian nesting dolls, you know? Ah, yeah. You
• 6:14
  think you're dealing with one company? But they
• 6:16
  rely on another who relies on another, each one
• 6:19
  a potential weak link. So boiling it down, what
• 6:23
  does this mean for you listening, whether you're
• 6:25
  just trying to keep your own data safe or you
• 6:27
  run a business? What are the practical lessons
• 6:29
  here? Well, for businesses especially, this needs
• 6:32
  to trigger some real action. It's not just theoretical
• 6:35
  risk anymore. First off, you absolutely must
• 6:38
  vet third -party vendors properly. before you
• 6:41
  integrate them. And that's more than just ticking
• 6:43
  boxes on a form, right? Oh, much more. It's digging
• 6:45
  into their security culture, their actual technical
• 6:48
  controls, how they handle incidents, even their
• 6:50
  technical debt. You can't just take their word
• 6:54
  for it. Need proof. Maybe independent audits.
• 6:57
  That sounds like a lot of work, especially if
• 6:59
  you use many vendors. It is. But it's essential.
• 7:02
  Second. Get strong cybersecurity clauses into
• 7:05
  your contracts. Make security standards, data
• 7:07
  protection rules, and breach notification requirements
• 7:09
  legally binding. Third, the principle of least
• 7:13
  privilege. We heard Hertz used Clio for limited
• 7:16
  purposes, but even that was enough. Only give
• 7:19
  vendors access to the absolute minimum data and
• 7:21
  systems they need to do their job. Nothing more.
• 7:24
  Seems obvious, but... I guess easy to let slip.
• 7:27
  Very easy. Convenience often wins over strict
• 7:29
  permissions. Or old access just doesn't get revoked
• 7:32
  when it's no longer needed. That's a ticking
• 7:34
  time bomb. Fourth, you have to monitor and audit
• 7:37
  what your third parties are doing. Continuously.
• 7:39
  Don't just set it up and forget about it. Regular
• 7:41
  checks, maybe pen testing your vendors if they're
• 7:44
  critical. Okay. Fifth batch, patch promptly.
• 7:46
  Obvious. But Clio's unpatched zero days were
• 7:49
  the way in here. That applies to everyone. Internal
• 7:51
  systems, vendor systems, everything. And finally,
• 7:54
  have an incident response plan that specifically
• 7:56
  thinks about third -party breaches. What happens
• 7:59
  if your vendor gets hit? How do you find out?
• 8:01
  How do you tell your customers? How do you make
• 8:02
  sure the vendor actually fixes it? Yeah, that's
• 8:05
  a scenario many probably haven't fully planned
• 8:07
  for. And thinking about Australian businesses,
• 8:09
  we're just as interconnected, aren't we? Relying
• 8:12
  on cloud services, SaaS platforms, the works.
• 8:16
  A breach in one supplier. Can cascade. Exactly.
• 8:19
  It can ripple right through the supply chain.
• 8:21
  That's why understanding cases like Hertz is
• 8:24
  vital. It's not just a big company problem. Any
• 8:27
  business, any size using external services. Faces
• 8:30
  this risk. So maybe the thinking, oh, we're too
• 8:32
  small or we only use reputable providers isn't
• 8:36
  quite enough. It's not. Because even those reputable
• 8:38
  providers might have their own vulnerabilities
• 8:40
  or their suppliers might. This raises that crucial
• 8:43
  question. How do you secure your entire digital
• 8:46
  world, not just your own little corner? The core
• 8:49
  message really is that security is shared. Everyone
• 8:52
  has a part to play. You need to secure every
• 8:54
  endpoint, every connection, internal systems,
• 8:56
  partner platforms, all of it. It's a constant
• 8:58
  effort. It's ongoing. Yeah. but totally necessary
• 9:01
  to protect trust, data, and ultimately your reputation.
• 9:05
  So the key takeaway from the Hertz breach. In
• 9:08
  this connected age, your security is really only
• 9:11
  as good as the weakest link in your digital supply
• 9:13
  chain. And often, as we saw here, that link is
• 9:16
  a third -party vendor. It's a serious reminder
• 9:19
  to look beyond your own walls. Definitely. And
• 9:22
  maybe a final thought for everyone listening.
• 9:23
  Just pause and think about all the apps and services
• 9:26
  you use daily. Your bank, streaming, shopping?
• 9:29
  How many different companies are actually involved
• 9:32
  in handling your data behind the curtain? And
• 9:34
  how would you even begin to check if those unseen
• 9:37
  partners are secure? It's tricky, but something
• 9:40
  we all need to be more aware of when we think
• 9:42
  about our own data safety. That's a really important
• 9:44
  point to ponder. And look, if today's discussion
• 9:47
  has got you thinking about your own business's
• 9:49
  security, or if you need some expert help navigating
• 9:52
  IT and cybersecurity, we do encourage you to
• 9:54
  check out www .kinsoft .com .au. The team there
• 9:58
  can help you talk through your specific needs,
• 10:00
  look at your risks, and make sure your digital
• 10:02
  setup is as strong and resilient as possible.
• 10:05
  Thank you so much for joining us on Tech Talks
• 10:07
  with Kinsoft today. We'll be back next time to
• 10:09
  unpack more of the stories shaping our tech world.