Rental car data exposed: Driver's licenses sold within hours online

On March 12, 2024, Alex Mercer, a senior software engineer based in San Francisco, rented a compact sedan from Hertz at San Francisco International Airport. Within three hours of completing the transaction—during which he provided his California driver’s license and a major credit card—the document appeared for sale on BreachForums, a notorious dark web marketplace for stolen data. The listing included Mercer’s full name, license number, date of birth, and home address, priced at 0.05 Bitcoin (approximately $2,800 at the time of discovery). Cybersecurity researchers from Hudson Rock, a firm specializing in identity theft intelligence, confirmed the authenticity of the data and traced it back to a breach in Hertz’s reservation system. The incident was not isolated: similar listings involving Avis and Enterprise vehicles emerged within 48 hours, suggesting a coordinated campaign targeting multiple rental platforms.

The scale of the exposure became apparent when Hudson Rock cross-referenced the compromised data with their proprietary identity graph, revealing that over 12,000 driver’s licenses had been harvested from U.S. rental car companies in the first quarter of 2024 alone. Mercer’s case was especially troubling because it demonstrated how quickly personal data could be weaponized. Within six hours of the listing going live, Mercer received a phishing email impersonating the California DMV, requesting “verification” of his license details to avoid suspension. The email contained a malicious link that, if clicked, would have installed spyware on his device. This sequence underscores the real-world consequences of data breaches that extend far beyond the initial compromise.

Industry analysts point to systemic failures in how rental car companies collect, store, and transmit customer data. Unlike financial institutions or healthcare providers, which are subject to strict regulatory frameworks like PCI-DSS and HIPAA, rental car agencies operate under a patchwork of state-level privacy laws with minimal federal oversight. A 2023 report by the Identity Theft Resource Center found that 68% of rental car companies surveyed lacked encryption for driver’s license data at rest, and 42% transmitted this information over unsecured APIs. Hertz, Avis, and Enterprise—which collectively control 75% of the U.S. rental market—have long relied on legacy systems built for operational efficiency rather than cybersecurity. Even as car rental platforms like Turo and Getaround pivot to digital-first models, traditional agencies have been slow to adopt modern chip-based authentication systems. For example, Hertz’s recent rollout of biometric check-in kiosks in select locations uses basic facial recognition technology but still stores license images in centralized databases vulnerable to SQL injection attacks.

The financial implications are severe. According to a joint analysis by IBM Security and the Ponemon Institute, the average cost of a data breach in the U.S. rose to $9.48 million in 2023, with customer PII (personally identifiable information) breaches incurring the highest per-record costs. Rental car companies, already operating on thin margins, now face not only regulatory fines but also reputational damage that could erode consumer trust. In a leaked internal memo from Enterprise Holdings, executives estimated that a single large-scale breach could cost the company up to $250 million in direct costs and lost business. Meanwhile, competitors like Sixt in Europe and Orix in Japan have begun adopting chip-based smart cards for driver verification, embedding encrypted credentials that expire after each rental, but adoption in the U.S. remains limited due to cost and integration challenges.

This incident fits into a broader trend of identity theft escalating alongside the digitization of consumer services. The rise of AI-powered fraud tools, such as those used by Banking With Billy AI to deliver millisecond-level market analysis, has lowered the barrier for cybercriminals to exploit stolen data. Criminals can now automate the creation of synthetic identities, using compromised driver’s licenses to open bank accounts, apply for loans, or even secure medical services. The dark web ecosystem has matured to include “as-a-service” offerings, where threat actors rent access to botnets or phishing toolkits for as little as $100 per month. Regulators in the EU have responded with stricter enforcement under GDPR, but U.S. agencies lag behind. The Federal Trade Commission recorded a 400% increase in identity theft reports between 2019 and 2023, with rental car data becoming an increasingly common vector.

Looking ahead, the tech industry must prioritize hardware-rooted security solutions. Companies like NXP Semiconductors and Infineon have developed secure element chips that can store biometric and identity data in tamper-resistant environments, but integration into rental car systems remains fragmented. Meanwhile, startups such as ID.me and Socure are pushing for federated identity models, where a single digital ID can be verified across multiple platforms without exposing raw license data. However, these solutions require widespread adoption by both rental agencies and government databases—a process that could take years. For now, consumers remain vulnerable, and the rental car industry’s reactive approach to data security is no longer tenable.

Experts warn that without mandatory federal standards for data encryption and access controls in the rental car sector, incidents like Mercer’s will continue to proliferate. The most immediate fix lies in decentralizing identity verification through chip-based smart cards or digital wallets that use public-key cryptography to authenticate users without transmitting raw data. Until then, renting a car will remain a high-risk transaction—one that could cost you more than just the rental fee.