Hertz Global Holdings (HTZ) said some of its users' personal data were stolen in a breach involving its Cleo Communications US vendor.

In February, the company confirmed that its data were acquired by an "unauthorized third party" that likely exploited zero-day vulnerabilities within Cleo's platform in October and December last year.

Hertz said "a very small" number of individuals may have had their social security or other government identification numbers, passport information, Medicare or Medicaid ID, or injury-related information tied to vehicle accident claims affected by the event.

The company said it reported the event to law enforcement and is in the process of reporting it to relevant regulators. The company has mandated Kroll to provide two years of identity monitoring or dark web monitoring services to potentially affected individuals at no cost, it said.