Cox confirms a cybersecurity incident at VinSolutions. If your customers’ data was involved, the notice deadlines may be yours.

By /

Cox Automotive says someone got into VinSolutions, the dealer CRM, and that a limited group of dealers is affected. A ransomware group claims it took Social Security numbers and credit applications. Cox has not confirmed what was taken, nor anything about the scope of the incident. If your customers are in it, the notice duties are probably yours, not Cox’s.

On October 26, 2026, Cox Automotive confirmed that it found and contained “suspicious activity” on VinSolutions, the customer relationship management (CRM) system that about 7,000 dealerships use to track leads, deals and customers. Cox said the activity “did not involve any encrypting malware,” did not stop dealers from using the system, and touched no other Cox product. It said a limited subset of VinSolutions dealers was affected, that outside cyber experts are working out what data was involved, and that it will notify affected parties directly.

Cox has not said how many dealers or customers are affected or what kind of information was taken.

What has been claimed, and what has not been confirmed

Three days before Cox’s statement, on Friday, October 23, a group calling itself the Scarlett Group listed VinSolutions on its leak site. It claims to hold customer records that include Social Security numbers, driver’s license numbers and credit applications. Cox has confirmed none of that. Ransomware.live, a site that logs these postings, describes the group as newly active and says its claims should be treated with caution until someone checks them.

Two security firms have published numbers. Hudson Rock, which tracks logins stolen by password-stealing malware on infected computers, linked about 214 VinSolutions user logins to the incident. A ParanoidLab snapshot suggested about 1,859 exposed passwords. Both figures count staff logins, not customers, and neither has been verified.

Why this is the dealership’s problem, not only Cox’s

The customer records in a CRM belong to the dealer. Federal and state breach laws put the duty to tell customers and regulators on the business that owns the data, and they put a separate, shorter duty on the vendor: tell the owner.

The FTC Safeguards Rule treats dealers as financial institutions, and “customer information” includes records kept “by or on behalf of” the store. If unencrypted information about 500 or more of your customers was taken, the store must report to the FTC as soon as possible and no later than 30 days after discovery (16 CFR 314.4(j)). The vendor is not required to, but may file it for you. (In fact, the FTC updated the breach reporting form after the CDK incident to allow for service providers to file an omnibus form on behalf of multiple financial institutions.)

Three details matter here:

  • If someone got unauthorized access to unencrypted customer information, the rule presumes they took it, unless the store has reliable evidence that they did not or could not reasonably have.
  • The 30 days run from the first day the store knows, and the rule counts what the store’s employees and agents know. Do not wait for Cox’s forensic report to start counting.
  • The FTC has said it will put these reports in a public database.

In almost every state, a vendor that holds data it does not own must tell the owner of an incident that could involve a breach of customer data, often “immediately.” The owner then owes notice letters to customers, and in many states a filing with the attorney general. The deadlines differ by the state each customer lives in, so a store with customers in several states has several clocks.

Vendors often offer to send the letters and make the filings for the dealer. That can work, but the duty remains the dealer’s. If the letter is late or leaves something out, the store is the one that missed it. If Cox offers to send letters for you, read the sample before you agree. After the 700Credit breach in late 2025, the vendor’s sample letter did not name the dealerships, but most state laws put the duty on the dealership. A letter that does not name your store may not count as your notice. California also requires specific headings and content, so one national letter may not satisfy every state.

What to do this week

  1. Ask Cox in writing whether your store is in the affected group, and keep the answer with its date. That date may start your state clocks.
  2. If it is, ask exactly what was taken: which fields, how many customers, which states they live in, the date range, and whether the data was encrypted. Ask Cox whether records from old deals and past customers are in scope, not only current ones. Customer records often stay in a vendor’s system long after the deal closes, and those customers are owed letters too. The FTC form and every state letter need these answers.

What was taken decides what you owe. The FTC report covers any ‘customer information,’ and the FTC says that includes even a plain list of the names and addresses of people who financed or leased with you. State letters usually need more, such as a name together with a Social Security number, a driver’s license number, or a login that opens an online account. So depending on the fields, a store may owe the FTC report and no state letters, or state letters and no FTC report.

  1. Ask whether Cox will send customer letters and regulator filings for your store, and get the answer in writing. Check Cox’s dates against your own deadlines; Cox’s timetable does not move yours.
  2. Reset every VinSolutions password at your store and remove anyone who has left. Two-step login is not optional. The Safeguards Rule requires it for anyone who logs in to a system that holds customer information, VinSolutions included, unless your Qualified Individual approves an equally secure control in writing. When you reset passwords, also end any sessions that are still logged in. Both published counts are about staff logins, which points to stolen staff passwords as one possible way in.
  3. Tell your Qualified Individual (the person who runs your Safeguards program) and open the incident under your written incident response plan. The Safeguards Rule requires that plan, and the plan must say how it will be reviewed and revised after a security event.
  4. Call your cyber insurer before you hire a lawyer or a forensic firm. Check whether your policy sets a deadline for reporting an incident and pays only for the insurer’s approved lawyers and forensic firms. Then tell IT and your vendors in writing to stop auto-deleting VinSolutions user logs, email, phone recordings and BDC texts. These often delete themselves after 30 to 90 days.
  5. Warn staff and customers about follow-on scams. A CRM holds names, phone numbers, email addresses, vehicles and deal history. Criminals use real details like these to make fake payoff, refund or recall messages sound genuine.
  6. Pull your VinSolutions contract and find who pays for customer letters, call centers and credit monitoring, and what Cox promised about security. When you pull the contract, find the cap on how much Cox can owe you and check whether data breaches are carved out of that cap.

What dealers learned from CDK

The best-known attack on dealer software is the June 2024 ransomware attack on CDK Global. Two court results from that attack bear on what a store can recover.

In a suit brought by a dealer group’s insurer against CDK, the court threw out the negligence claims under Illinois’s economic loss rule, which bars suing in negligence for purely financial losses that come from a failed contract. Only the contract claim survived. In practice, what a store can get back from its vendor after a breach depends mostly on what the contract says.

The consumer class action against CDK, consolidated in federal court in Chicago, is still undecided. In March 2026 the judge let the plaintiffs gather evidence on whether the court has jurisdiction over CDK and put CDK’s request to dismiss the case on hold until that is done.

We will update this story when Cox says what data was involved and how many dealers are affected.

How ComplyAuto can help

ComplyAuto’s privacy solution contains a “data breach wizard” that you can use (if needed) to determine your customer and regulator notice requirements in your state – if your data was involved in the incident.  It will walk you through any requirements and deadlines – and more.  In addition, ComplyAuto will help you to document this incident in your written incident response plan, and ensure that your annual board report is updated appropriately.

Contact ComplyAuto today to learn more about how we can help.

Sources

Scroll to Top