Avis Car Rental suffers a data breach, exposing the personal information of customers

Prominent car rental company Avis Car Rental has reported a data breach that exposed the personal information of its customers after an unauthorized party gained access to one of its business platforms. The breach, which occurred between August 3 and August 6, 2024, compromised sensitive customer data, including names and possibly other confidential details. The company has since halted the attack, launched an investigation with the assistance of cybersecurity specialists, and informed law enforcement of the incident.

Avis first became aware of the breach on August 5, 2024, and immediately began efforts to secure its systems. On September 4, after confirming that customer data had been accessed, Avis began notifying affected individuals. While the exact types of compromised data were not fully disclosed, a letter to customers noted that personal details, including names, had been exposed. A sample letter sent to Californian authorities did not provide specific details about the other sensitive data involved, as they were redacted.

In its communication to customers, Avis stated: “As soon as we learned about the incident, we took action to stop the unauthorized access, started an investigation with support from cybersecurity experts, and notified the appropriate authorities.” The company emphasized its swift response, working closely with cybersecurity experts to strengthen its security framework and protect its systems from future attacks.

Avis, part of the Avis Budget Group, operates in more than 165 countries, making it a major global player in the car rental industry, particularly in airports and cities. Given its vast customer base of business and leisure travelers, the scale of this breach raises concerns about the potential widespread impact.

To mitigate the effects of the breach, Avis is offering affected customers a free one-year membership with Equifax credit monitoring services. This includes identity theft insurance, credit report monitoring, alerts for significant changes, and fraud detection services. Customers have until December 31, 2024, to enroll in the program.