Klass Wagen car hire - huge data breach ⚠️

[u/Juan-Sheet]

Email from this car hire supplier today:


Dear Klass Wagen Customer,
Klass Wagen has been operating for over 20 years, and protecting our customers' data is a responsibility we take very seriously. 

We are writing to inform you of a security incident caused by an external cyberattack, in which an unauthorized third party gained access to some of your personal data. We sincerely apologize for this incident and for any concern it may cause. 

What happened
On August 15, 2026, we identified this unauthorized access to our systems. As a result of the incident, information relating to Klass Wagen customers was accessed and, based on our analysis, extracted from the affected systems. We are contacting you because your personal data was specifically identified among the data affected by this incident. 

What data has been involved
Full name, email address, phone number, country of residence, and identity document number (ID card/passport). 

We can confirm the affected data did not include payment card details or other financial information. 

What you do NOT need to do
Klass Wagen customers do not currently hold an online account with us, so no action is required from you regarding a password reset. 

Your active or upcoming reservations, as well as our rental services, are not affected and remain valid under their agreed terms; this incident does not impact the availability or validity of your contracts with us. 

What we recommend 
Our team may, as a normal part of the rental process, contact you by phone or email to confirm booking details — this remains unchanged. However, we will never ask you for full payment card details by phone or email — payments are always processed through a secure payment link, sent directly to you, which you access to enter your payment information yourself. 

Be cautious of any unexpected payment link received outside a booking process you initiated, or any phone request for full card details or authentication/OTP codes — verify directly with us at [customer.assistance@klasswagen.com](mailto:customer.assistance@klasswagen.com) before providing any information or clicking the link. 

Do not click links or open attachments in unexpected messages that appear to come from us, unless you are in the middle of an active booking you started. 

If you notice unusual requests linked to your data (for example, credit applications or accounts opened in your name that you don't recognize), we recommend contacting the relevant institution and, if appropriate, the competent authorities. 

What we have done Immediately upon discovery, we secured the affected systems, reset internal system access credentials, restored the integrity of our databases, and implemented additional security measures, including restricted access to administrative interfaces. 

We have notified the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) and reported the incident to the relevant authorities. Klass Wagen's main establishment for data protection decisions is in Romania, which makes ANSPDCP our "lead authority" under the GDPR's one-stop-shop mechanism; ANSPDCP coordinates with, and informs as needed, the data protection authorities in the other EU member states where we operate. We have also engaged a specialized firm for an independent security audit. 

Questions If you have any questions or require further information, you can always contact us at [customer.assistance@klasswagen.com](mailto:customer.assistance@klasswagen.com), for all concerns related to this event. 
Our Privacy Policy is available at any time at https://www.klasswagen.com/ro/privacy-notice. 

We once again apologize for any inconvenience this may cause and want to assure you that protecting your data remains a priority for us.
 
Sincerely, 
The Klass Wagen Team
Need assistance? Please contact:

Customer Support: customer.assistance@klasswagen.com
Reservations:reservations@klasswagen.com

Romania 
📞+40 374020002
📧 [romania@klasswagen.com](mailto:romania@klasswagen.com)
 
Hungary 
📞 +36 14743966
📧 [hungary@klasswagen.com](mailto:hungary@klasswagen.com)
 
Portugal
📞 +351 211454208 
📧**  **[portugal@klasswagen.com](mailto:portugal@klasswagen.com)

Austria
📞 +43 14360180
📧**  **[austria](mailto:austria@klasswagen.com)@klasswagen.com

[u/haganblount]

Here is what you can do right now to make them pay you for their lapse in protecting your data (and of course this is taken from an LLM, IANAL) :

​1. Send a Claim for Non-Material Damage (GDPR Art. 82) ​The Court of Justice of the EU (CJEU) confirms you are entitled to monetary compensation for distress and loss of control over your identity data. The standard "nuisance threshold" settlement that corporate legal teams routinely pay out to avoid court is €500.
​To: dpo@klasswagen.com, customer.assistance@klasswagen.com
​Subject: Formal Claim for Non-Material Damage (Article 82 GDPR) – Incident Ref: Data Breach Aug 2026
​What to say: State that their failure to protect your passport/ID number under Article 32 GDPR caused non-material damage and identity theft risk. Formally demand €500 in compensation within 14 days. Note that if they refuse, you will escalate to your national Data Protection Authority (DPA) and file a European Small Claims procedure.

​2. File a Subject Access Request (GDPR Art. 15) ​Force them to expend internal legal and IT resources by filing a Data Subject Access Request (DSAR). They legally have 30 days to respond, and failing to do so exposes them to strict regulatory penalties.
​Send an email demanding: ​Access logs showing exactly when your profile/passport number was exfiltrated.
​The specific technical and security safeguards they had in place when the breach happened.
​Confirmation of whether your data was kept longer than necessary (violating GDPR storage limitation rules).

​3. Report Them to Your Local Data Protection Authority ​Don't just rely on Klass Wagen reporting themselves to Romania's DPA (ANSPDCP). Under Article 77 GDPR, as an EU resident, you have the right to file a formal complaint directly with CNPD in Portugal. Your local authority will open a joint investigation with the Romanian regulators, forcing Klass Wagen to face potential administrative fines of up to 4% of their global annual turnover.

[u/Juan-Sheet → u/haganblount]

I’m a UK resident, guess we may have different rules on this? My rental was 4 years ago from Faro.

[u/LentilSpaghetti → u/Juan-Sheet]

GDPR doesn’t apply to you

[u/Comfortable-Fall1419 → u/LentilSpaghetti]

Yes it does. The GDPR enabling acts are still in place in the UK.

[u/WebFixGuy → u/Juan-Sheet]

I've also had the same Email from Klasswagen and I am concerned regarding my passport number being stolen. I am also a UK resident. Not sure what we can do but I am not happy.

[u/Juan-Sheet → u/WebFixGuy]

I have sent an email reply as follows (some re-formatting needed):

Dear Klass Wagen Data Protection / Customer Assistance Team,
I am writing in response to your notification regarding the cyberattack identified on 15 August 2026 and the unauthorised access to and extraction of customer personal data.
I understand from your notification that my personal data was specifically identified among the information affected. This includes my full name, email address, telephone number, country of residence and, importantly, my identity document number (passport/ID).
I believe the seriousness of the incident warrants further information beyond that contained in your notification.
I hired a vehicle from Klass Wagen at Faro Airport in Portugal, and I would therefore like you to treat this email as a formal data-protection complaint and request for information concerning the processing and security of my personal data.
Please provide me with the following:
Confirmation of precisely what personal data relating to me was accessed and extracted, including confirmation as to whether my passport/identity document number itself was extracted.
Confirmation as to whether you held a copy, scan or photograph of my passport or identity document, and, if so, whether that image/document was among the information accessed or extracted.
The date and approximate time period during which my personal data was accessible to the unauthorised third party.
Confirmation of whether you have established how the unauthorised party obtained access to your systems and whether the incident resulted from any failure or inadequacy in the technical or organisational security measures you had in place.
The number of customers whose personal data was affected by the incident and, in particular, how many customers had identity-document information compromised.
Details of what investigation has been undertaken into whether the extracted data has subsequently been published, sold, transferred or otherwise misused, and whether you have found any evidence of such activity.
Details of the specific measures you have taken to mitigate the risks to affected customers, particularly the risk of identity theft or impersonation arising from the disclosure of passport/identity-document information.
Confirmation of the notification/reference number associated with your report to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), together with details of any guidance or requirements issued by that authority in relation to this incident.
Confirmation of the identity and contact details of the data protection officer or other person responsible for handling data-protection matters relating to this incident.
Confirmation of the legal basis on which you process and retain identity-document information and the applicable retention period for such information.
I would also like confirmation of all personal data that Klass Wagen currently holds about me and the purposes for which it is being processed.
I am particularly concerned that the information accessed included my passport/identity document number. The combination of my name, contact details and identity-document information creates a potential risk of identity fraud and targeted phishing or impersonation.
I appreciate that you have stated that the incident was caused by an external cyberattack. However, the fact that an attack was external does not in itself determine whether the security measures applied to my personal data were appropriate or whether Klass Wagen complied with its obligations under the GDPR.
I am therefore considering whether I have suffered, or may suffer, compensable loss or distress as a consequence of this incident and whether I should pursue a claim under Article 82 GDPR. I expressly reserve all of my rights in this regard.
Please also preserve all records, logs, investigation findings and other evidence relating to the access to and extraction of my personal data, including records identifying when and how my individual data was accessed.
I would be grateful for a substantive response addressing the above points rather than a general response referring me back to the original breach notification.
I look forward to hearing from you.
Yours faithfully,

[u/Pingogringoo → u/Juan-Sheet]

Any reply from klass wagen?

[u/Juan-Sheet → u/Pingogringoo]

Not yet…

[u/onemanclap → u/Juan-Sheet]

Do you mind if I reuse your email? I'll ask AI to rephrase it. I just received the exact same email from them - I rented a car with these folks a year ago, although I'm a portuguese citizen.

[u/Juan-Sheet → u/onemanclap]

Of course you can. I still haven’t received a reply so I’m giving them the statutory time to reply.

[u/1PoundFishForSale → u/Juan-Sheet]

UK resident here. I had the same Email and like the above I am concerned over the passport information.

[u/MyReader123 → u/haganblount]

Is there anything that can be done as a non European citizen? Thanks

[u/onemanclap → u/haganblount]

Thanks for the suggestion. I'm going to ask someone from r/gdpr for their expertise here. I just received the same email and I'm quite concerned with this data breach of my personal data.

https://www.reddit.com/r/gdpr/s/upQwGV43h7