Cox Automotive says no encrypting malware touched VinSolutions, that the dealer CRM is the only product affected, and that stores can keep working while it and outside investigators sort out what happened. The company has declined to specify the locations, the number of records, or the kinds of data.
A group calling itself Scarlett Group posted VinSolutions to a leak site on October 23, claiming customer records including Social Security numbers, licence numbers and credit applications, with a threat to publish unless it was contacted. A leak threat is an extortionist’s claim rather than a finding. But it points at files, not uptime, and a CRM that still loads leads says nothing about whether records left.
The federal Safeguards Rule, 16 CFR Part 314, puts the timing problem on the dealership. Where unencrypted records on at least 500 consumers are taken without authorization, the dealer must notify the FTC promptly and within 30 days of learning of it. The rule treats knowledge held by an employee, officer or other agent as discovery, and it presumes a breach absent proof otherwise.
That inverts the usual instinct. A dealer needs evidence that nothing was taken, and the only party holding logs that could settle it is the vendor. A store’s notification deadline therefore runs on someone else’s forensic schedule, and its contract duties to vet that vendor are its own.
For car buyers the practical risk is what follows a leaked file: a call that knows the vehicle shopped, the store visited and the deal in progress, asking for a payment confirmation.
