The VinSolutions incident: what Cox Automotive has said, and what a dealer should do this week

In short: Cox Automotive says it detected and contained "suspicious activity" on VinSolutions, its dealership CRM, and that a limited subset of dealers was affected. A hacking group claims it took customer records. Cox has not confirmed that. If your store runs VinSolutions, this week is for questions, not assumptions.

On Friday, October 23, 2026, a group calling itself Scarlett Group listed VinSolutions on a ransomware leak site and claimed to have taken dealership customer records. Screenshots of the listing circulated over the weekend. On Monday, October 26, Cox Automotive gave Auto Remarketing a statement confirming "suspicious activity that was limited to VinSolutions." VinSolutions is the CRM where many stores keep every lead, every customer conversation, and in some stores the credit application itself. Auto Remarketing puts its footprint at about 7,000 dealerships.

What Cox Automotive has confirmed

Cox's statement, as published by Auto Remarketing on October 26, says five things:

1. It recently detected suspicious activity that was limited to VinSolutions and did not affect other Cox Automotive solutions or platforms.
2. The activity was quickly contained, did not involve any encrypting malware, and did not disrupt customers' ability to use VinSolutions.
3. It is working with outside cyber experts to determine the nature and scope of any data that was involved.
4. Based on the investigation so far, it believes the activity affected a limited subset of VinSolutions dealers.
5. It will notify any affected parties directly and in line with its obligations.

Cox has not said how many dealers are in that subset, how many consumers are involved, or what information was involved. As of the morning of October 27, it has not named the group or confirmed any of the group's claims.

What is claimed but not confirmed

The group's leak-site listing claims customer records including Social Security numbers, driver's license numbers, and credit applications. Threat-intelligence trackers that recorded the listing describe the group as newly active and say its claims should be treated with caution until verified. Numbers of affected users and passwords have been posted by third-party monitoring firms. None of this has been confirmed by Cox, and this post does not repeat the figures.

A plaintiffs' firm has posted a notice that it is investigating a possible class action and is asking dealership customers and staff to come forward. As of October 25, no lawsuit had been filed.

Why this lands on the dealer, not just the vendor

Under the FTC Safeguards Rule, the dealer is the financial institution. The rule does not stop applying because the data sat in a vendor's system. Three parts of the rule are in play:

Service provider oversight. The rule requires a dealer to select service providers that can maintain appropriate safeguards, to require those safeguards by contract, and to periodically assess them. A vendor incident is the moment that paperwork gets read.

Incident response. The rule requires a written incident response plan that says who does what when there is a security event involving customer information. That plan is supposed to exist before the event.

Notification to the FTC. Since May 2024, a dealer that discovers a notification event involving the unencrypted information of at least 500 consumers must notify the FTC as soon as possible and no later than 30 days after discovery. Whether a vendor-side event is your notification event, and when the clock starts, is a question for counsel, but it is a question to ask now rather than in 29 days.

State breach-notification laws sit alongside the federal rule and generally run from the business that owns the data, which in most cases is the dealership.

Practical takeaways

1. Ask your Cox Automotive representative, in writing, whether your store is in the affected subset, and keep the answer. If the answer is no, you want that on file. If it is yes, the rest of this list is urgent.
2. Pull your VinSolutions agreement and find the security and incident-notification clauses. Note what Cox promised, and when it promised to tell you. That is the "require safeguards by contract" piece of the Safeguards Rule.
3. Review who has a VinSolutions login at your store. Remove former employees, confirm multi-factor authentication is on for every user, and have staff change passwords they reuse anywhere else. Most intrusions start with a credential, whatever happened here.
4. Open your incident response plan and confirm the people named in it still work for you and know their roles. If you cannot find the plan, that is the finding.
5. Decide with counsel, now, how you will handle FTC and state notification if Cox tells you your customers' information was involved. Write down the decision and who owns the clock.
6. Warn the sales and F&I floor that a public incident is a phishing season. Messages that look like they come from Cox, from "IT," or from worried customers should be verified by phone before anyone clicks.

Log all six in your Safeguards file with dates. If an examiner, a plaintiff, or an insurer asks what you did the week the news broke, the answer should be a list, not a memory.

This explainer is general information about a reported security incident at a third-party vendor, not legal advice, and it does not describe DealSafe's relationship with any Cox Automotive product. Facts are as reported on October 26 and 27, 2026, and may change as Cox's investigation continues. Talk to your counsel.

Sources: Auto Remarketing, "Cox Automotive spots 'suspicious activity' connected to VinSolutions that was 'quickly contained'" (Oct. 26, 2026); CBT News, "Hacking group claims data theft at VinSolutions, Cox investigating 'suspicious activity'" (Oct. 27, 2026); Car Dealership Guy, "Cox Automotive confirms VinSolutions cyber incident, says activity contained" (Oct. 26, 2026); FTC, Standards for Safeguarding Customer Information, 16 CFR Part 314.

See also

FTC Safeguards Rule program for dealers · FTC Safeguards Rule Checklist for Auto Dealers · Enforcement Watch · All guides and news