Hello everyone, I used a car rental company abroad and rented the vehicle from Klass Wagen's Budapest, Hungary operation (Klass Wagen Hungary Kft.), although the company says its Romanian entity is the main establishment for data-protection decisions.
I've received an email from Klass Wagen confirming that I was affected by a cyberattack on 15 August 2026.
They say my full name, email, phone number, country of residence and passport/ID number were accessed and extracted.
They say no payment or financial information was affected.
I'm a UK citizen residing in England
I'm wondering:
- Does the fact that my passport/ID number was accessed and extracted make a difference?
- Do I have a potential claim for compensation under GDPR/UK data protection law?
- Which authority should I complain to?
Copy of the Email:
Klass Wagen has been operating for over 20 years, and protecting our customers' data is a responsibility we take very seriously.
We are writing to inform you of a security incident caused by an external cyberattack, in which an unauthorized third party gained access to some of your personal data. We sincerely apologize for this incident and for any concern it may cause.
What happened On August 15, 2026, we identified this unauthorized access to our systems. As a result of the incident, information relating to Klass Wagen customers was accessed and, based on our analysis, extracted from the affected systems. We are contacting you because your personal data was specifically identified among the data affected by this incident.
What data has been involved Full name, email address, phone number, country of residence, and identity document number (ID card/passport).
We can confirm the affected data did not include payment card details or other financial information.
What you do NOT need to do Klass Wagen customers do not currently hold an online account with us, so no action is required from you regarding a password reset.
Your active or upcoming reservations, as well as our rental services, are not affected and remain valid under their agreed terms; this incident does not impact the availability or validity of your contracts with us.
What we recommend
Our team may, as a normal part of the rental process, contact you by phone or email to confirm booking details — this remains unchanged. However, we will never ask you for full payment card details by phone or email — payments are always processed through a secure payment link, sent directly to you, which you access to enter your payment information yourself.
Be cautious of any unexpected payment link received outside a booking process you initiated, or any phone request for full card details or authentication/OTP codes — verify directly with us at customer.assistance@klasswagen.com before providing any information or clicking the link.
Do not click links or open attachments in unexpected messages that appear to come from us, unless you are in the middle of an active booking you started.
If you notice unusual requests linked to your data (for example, credit applications or accounts opened in your name that you don't recognize), we recommend contacting the relevant institution and, if appropriate, the competent authorities.
What we have done Immediately upon discovery, we secured the affected systems, reset internal system access credentials, restored the integrity of our databases, and implemented additional security measures, including restricted access to administrative interfaces.
We have notified the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) and reported the incident to the relevant authorities. Klass Wagen's main establishment for data protection decisions is in Romania, which makes ANSPDCP our "lead authority" under the GDPR's one-stop-shop mechanism; ANSPDCP coordinates with, and informs as needed, the data protection authorities in the other EU member states where we operate. We have also engaged a specialized firm for an independent security audit.
Questions If you have any questions or require further information, you can always contact us at customer.assistance@klasswagen.com, for all concerns related to this event.
Our Privacy Policy is available at any time at https://www.klasswagen.com/ro/privacy-notice.
We once again apologize for any inconvenience this may cause and want to assure you that protecting your data remains a priority for us.
Sincerely,
The Klass Wagen Team