Cox Automotive has told the dealer trade that the suspicious activity at VinSolutions, its dealer CRM, was contained, involved no encrypting malware and hit a limited group of dealers. That statement isn’t on Cox’s own press-release page; the two VinSolutions items I found there on October 30 are product announcements dated August 31 and October 8. Here’s what holds whatever the final count turns out to be: federal rules treat the dealer, not the vendor, as the party answerable for customer data.
What Cox has said, and what nobody has confirmed
Cox says it is working with outside cybersecurity experts, that VinSolutions is the only Cox Automotive product affected, that dealers can still use the platform, and that affected dealers will be notified. It has not said which dealers, how many, or what kind of data is involved.
The other side of the story comes from a group calling itself Scarlettgroup. A threat-intelligence site that archived its October 23 posting quotes it as saying: “VinSolutions has been compromised. Sensitive data will be leaked unless immediate communication is established.” That is an extortionist’s claim, not a finding. I found no Cox breach notice and no state attorney general filing that names VinSolutions, and circulating figures about stolen user accounts and passwords are unverified, so they are left out here.
A platform that stays online says little about stolen files
Encryption is what takes a system down. Theft is what exposes customers. Cox’s statement that no encrypting malware was involved explains why dealers could keep working, but it does not address whether files left the building, and the group’s own post threatens a leak, not an outage. Dealers watching a CRM that still loads leads and logs calls have been given a reason to feel fine that has little to do with the question the FTC will ask.
The FTC rule puts the dealer on the clock
Auto dealers are covered by the FTC’s Safeguards Rule, 16 CFR Part 314, and the agency publishes an FAQ written for dealers. Two provisions matter here. The first is the notification requirement: when unencrypted customer information of at least 500 consumers is acquired without authorization, the dealer must report to the FTC as soon as possible and no later than 30 days after discovery, using an electronic form on the FTC site. The second is that unauthorized access to unencrypted customer information is presumed to be unauthorized acquisition unless the institution has reliable evidence that nothing was or could reasonably have been taken.
That presumption flips the usual instinct. A dealer cannot shrug and wait for proof of theft; it needs proof of no theft, and the only party holding the logs that could supply it is Cox. A dealer’s notification timeline therefore depends on a vendor’s forensic timeline. The rule counts knowledge held by any employee, officer or other agent of the dealer as discovery, and whether a CRM vendor qualifies as an agent is a question I found no FTC language settling, so expect dealer lawyers to be asking it.
The rule also requires dealers to take reasonable steps to select and retain service providers able to maintain safeguards, require those safeguards by contract, and periodically assess the providers based on the risk they present. The FTC’s FAQ says whether a vendor counts as a service provider turns on whether it handles customer information. A CRM that sits between a web lead and a signed deal generally does. Dealers will now be hunting through their VinSolutions contracts for the language on breach notice and indemnity.
What a dealer CRM holds
What VinSolutions held for the affected stores is not public. Its own website markets data append for phone, email and VIN records, Cox first-party shopper data, and workflows for online shopping, payments and in-store deals. A CRM is where a web lead becomes a customer file, and depending on how a store configures it, that file can reach into trade-in details and financing steps. Cox announced on October 8 that mutual clients of VinSolutions and Fullpath would get an embedded customer data platform, which pulls even more customer records into the same system.
For buyers, the practical risk is not the leak itself but what follows it: a text or call that knows your name, the car you shopped for and the dealership you visited, asking you to confirm a payment or sign a document. That is the kind of detail that makes a fraud attempt convincing. Auto businesses are already paying for how they handle customer data; this week we covered GM’s $220 million driver-data settlement and a driver-records breach in Florida that began with a single login.
What to watch
The answers will come from paper. A Cox notice to dealers will say what categories of data were involved. State attorney general breach filings, which typically list the number of residents affected, will put a figure on consumers. And any Safeguards Rule submissions will show up indirectly, in dealer letters to customers. If you bought or financed a car in the past few years and get one of those letters, read which data types it lists before you decide how worried to be.
If a dealer’s software vendor leaks your buyer file, who should pay for the credit monitoring and the cleanup: the dealer that chose the vendor, or the vendor that lost the data?