Cox Automotive has confirmed that it is working with outside cyber experts to investigate suspicious activity on VinSolutions, the customer relationship management (CRM) platform that thousands of US car dealerships use. A Cox spokesperson told CDG News on October 26 that "the activity was quickly contained, did not involve any encrypting malware, and there was no disruption to our customers' ability to use VinSolutions." The confirmation came three days after a new extortion group calling itself Scarlett Group listed vinsolutions.com as a victim on its leak site. CDG News reports that data from 214 VinSolutions users was allegedly compromised, citing credential-monitoring firm HudsonRock. A separate snapshot attributed to ParanoidLab put exposed passwords at about 1,859. Cox has not confirmed either figure or said what data was taken.
What Happened
- October 23: Ransomware tracker Ransomware.live recorded Scarlett Group's listing of VinSolutions. HookPhish reported the same claim. Ransomware.live describes Scarlett Group as a newly active gang and says its claims "should be treated with caution until independently verified." On the same day, Brinztech and Darkwiser reported a separate post on a dark web forum in which a group calling itself SCARLETTGROUP claimed to have breached VinSolutions and threatened to leak or sell the data unless the company contacted it.
- October 23 to 25: Plaintiff law firms working with ClassAction.org started asking VinSolutions employees, dealership staff and dealership customers to come forward. As of October 25, Settlement Insight found no lawsuit, no notification letters and no state attorney general filing.
- October 26: Cox Automotive confirmed the incident to CDG News. The spokesperson said VinSolutions is the only Cox Automotive product affected, that the company believes "a limited subset" of dealers on the platform were involved, and that it is "working diligently with outside cyber experts to determine the nature and scope of any data that was involved."
CDG News published part of the attackers' ransom note: "We breached your organization and infrastructure! The data remains in our possession until the negotiation deadline has passed." Another part taunted the company: "Didn't see that coming, huh? Neither did your security team."
What Was Taken
Cox has not said what data was taken, and the attackers' claims go well beyond anything the company has acknowledged.
Numbers in circulation. CDG News reports two snapshots that were posted alongside the leak-site listing. HudsonRock's snapshot points to 214 VinSolutions users, and ParanoidLab's points to roughly 1,859 passwords. Both firms label these as infostealer findings, meaning credentials stolen from infected user devices. That is not the same as records taken from VinSolutions itself. CDG News states that the number of affected users and passwords is unconfirmed. No reported record count exists for customer data, and Darkwiser lists the record count as "not stated."
What the attackers claim. According to Brinztech, Darkwiser and Class Action U, the forum post claims the group took: - VinSolutions CRM databases, Cox dealer web applications and document management files - Customer Social Security numbers, driver's license numbers and images, and dates of birth - Banking and income details, employer data and credit applications - CRM conversation threads, dealership staff accounts and credentials, system configuration files and keys for third-party vendor portals
Settlement Insight points out that it is unclear whether the forum post and the leak-site listing describe the same event. None of these data types has been confirmed by Cox or any regulator.
Why It Matters
VinSolutions sits in the middle of the dealership sales process. On October 8, Cox described it as the industry's "number one CRM trusted by thousands of dealerships nationwide." The same announcement said VinSolutions was embedding Fullpath's AI customer data platform, which brings shopper website activity and enriched profiles into the CRM record. Most of the data in VinSolutions belongs to dealerships and their buyers, not to Cox. Anyone who shopped for, leased or financed a car at a dealer that uses the platform may have a record there.
The pattern is a familiar one. Even if a single vendor compromise touches only "a limited subset" of tenants, it can expose many independent businesses at once. Dealers also hold exactly the kind of identity and credit-application data that fraudsters want. Last but not least, the infostealer figures suggest that dealer staff logins to the platform are already circulating, whether or not they played a part in this intrusion.
The Attack Technique
The initial access route has not been disclosed. Cox has said only that no encrypting malware was involved, which fits a data-theft-and-extortion operation rather than a traditional ransomware deployment. The HudsonRock and ParanoidLab snapshots raise the possibility that the attackers used credentials stolen by infostealers to log in to dealer or staff accounts. Nobody has confirmed that this is how the attackers got in, and the figures may simply reflect credential exposure in the background. Brinztech's claim that third-party vendor portal keys were taken, if true, would mean the stolen data could enable further intrusions.
What Organizations Should Do
- Dealers on VinSolutions: Reset passwords for all staff CRM accounts, enforce multi-factor authentication, and revoke any API keys or integration tokens connected to the platform, including those used by connected vendors such as Fullpath.
- Check for infostealer exposure: Search infostealer feeds for your dealership domains and staff emails. Reimage any device that turns up, not just the password.
- Review CRM access logs: Look for bulk exports, unusual report runs, new user creation and logins from unfamiliar IP addresses or devices since early October.
- Prepare for impersonation: Warn sales and finance staff about phishing and fake-customer pretexts that use real deal details from CRM conversations, and warn customers too if Cox confirms your store was in the affected subset.
- Press Cox for specifics: Ask whether your rooftop was in the affected subset and request indicators of compromise. Under state breach laws, dealers may carry their own notification obligations for customer data.
- Vendor risk: Use this incident to review which SaaS vendors hold Social Security numbers and credit applications on your behalf, and what their contracts commit them to in breach notification timelines.
Sources: Cox Automotive confirms VinSolutions cyber incident, says activity... | VinSolutions Data Breach? Attorneys Investigate Hackers' Claims | VinSolutions Data Breach Lawsuit: Hacker Claim, No Case ... | Cox Automotive’s VinSolutions Embeds Fullpath's AI-Powered Customer... | VinSolutions Data Breach Lawsuit - Class Action U | Threat Actor 'SCARLETTGROUP' Claims Major Data Extortion Breach of... | VinSolutions Customer Personal and Financial Records ... | Cox Automotive confirms VinSolutions cyber incident, says activity...