Avis Car Rental LLC has disclosed that it has suffered a “data security incident” with customer information stolen.

Disclosed in a Sept. 4 letter to customers filed with the California Attorney General, the incident took place on Aug. 5 and involved an authorized third party gaining access to one of the company’s business applications. Once becoming aware of the incident, Avis launched an investigation with assistance from cybersecurity experts and alerted relevant authorities.

The investigation, which delivered its results on Aug. 14, determined that the unauthorized access occurred between Aug. 3 and Aug. 6. Avis has since developed a plan to enhance security protections and has implemented additional safeguards into its systems. Affected customers are being offered complimentary credit monitoring through Equifax Inc.

In a separate filing with the Office of the Maine Attorney General, Avis disclosed that the number of persons affected in the reach total 299,006 customers, so the investigation appears thorough.

What’s missing from the story is what actually occurred. Though there’s always a chance in attacks such as these that ransomware could be involved, there’s no suggestion of services being disrupted, which would be typical in a ransomware attack.

That means it could be a simple hacker gaining access to internal systems and stealing data. It could also be a case in which Avis had intercepted a hacker who had established persistence on their network before any ransomware or other malicious software was deployed.

Sean Deuby, principal technologist at Active Directory security and recovery firm Semperis Inc., told SiliconANGLE via email that “while details of the recent Avis intrusion are scant and we’re not privy to how disruptive this attack was to Avis corporate employees and the nearly 300,000 customers apparently impacted, I am encouraged by the company’s quick response and its implementation of additional safeguards to its systems and customer data.”

He added that “unfortunately, persistent threat actors will target certain companies and look for gaps in their security architecture until they find a weak spot and steal whatever they want. Having a backup and recovery plan in place is an essential part of improving operational resiliency.”

Photo: Michael Gray/Flickr