A group calling itself Scarlett Group posted VinSolutions to a leak site on Friday, claiming customer records that include Social Security numbers, driver’s licence numbers and credit applications. Cox Automotive has confirmed none of it, published no record count and named no data fields.
What the vendor actually said
Cox detected suspicious activity confined to VinSolutions, its customer relationship platform for dealerships. It said the activity was quickly contained, involved no encrypting malware and did not interrupt dealers’ use of the system. Other Cox Automotive platforms were unaffected. It believes a limited subset of dealers was in scope and will notify affected parties directly while outside cyber experts work out what data was involved.
Scale matters. Auto Remarketing reports about 7,000 dealerships use the platform, which holds financing enquiries, trade-in details and contact histories rather than the vehicles themselves. Ransomware.live logged the listing but called Scarlett Group newly active and advised caution until the claims are verified. Darkwiser flagged the same caveat.
The liability runs downhill, not away
Attorneys are circling. ClassAction.org posted an investigation page sponsored by Bryson Harris Suciu & DeMay, asking dealership customers and staff to come forward.
The sharper warning came from Lefkoff Law principal Steven Lefkoff, who told Auto Remarketing the exposure reaching individual stores could be enormous because the dealer, not the vendor, carries the duty. Stores arranging financing fall under the FTC Safeguards Rule, which requires oversight of vendors holding customer data. Should unencrypted records for 500 or more people be acquired, the dealer may owe the FTC its own notice within 30 days of discovery. Lefkoff noted the threshold counts credit applications, not sales, so a run of tyre-kickers can clear it.
Dealers should ask their Cox representative whether their store sits in the affected set.
