Cox Automotive told trade publication Repairer Driven News on Friday that it found suspicious activity confined to VinSolutions, the customer relationship system thousands of dealerships use to track buyers and credit applications.
The company says the activity was contained, involved no encrypting malware and never interrupted access. It has not published a record count, a data category list or a number of affected stores, and it has not confirmed the claims a group calling itself Scarlett Group posted on its leak site on October 23.
What the crew says it holds
A monitoring service quoted early coverage that described customer files containing Social Security numbers, driver’s license numbers and credit applications, while flagging the claims as unverified. Cox will only say it believes a limited subset of dealers was touched and that it will notify affected parties directly.
Law firms are already advertising for potential plaintiffs, which usually means a class action follows whether or not the initial claim holds. Auto Remarketing has put VinSolutions use at about 7,000 dealerships.
Why a CRM is the worst place for this
A dealer’s CRM is not a nuisance system. It holds finance applications, trade-in paperwork and every identity document a shopper hands over to close a sale, which is precisely the material Scarlett Group says it took.
The same reporting roundup noted a separate tip about phishing links reaching collision-center estimating accounts, with attackers resetting passwords and impersonating shops to insurers. One vendor’s confirmation, in other words, is now part of a broader campaign against the software layer dealers depend on.
