The VinSolutions Data Breach: What Dealers Should Do While the Facts Come In

If your dealership uses VinSolutions, treat Cox Automotive’s October 26 incident as unresolved: reset staff passwords, confirm MFA, review connected integrations, ask your Cox representative in writing whether your store was affected, and document every step.

Last updated: October 30, 2026

The facts below are current as of October 30, 2026, and every one of them is dated and sourced. We’ll update this post as Cox Automotive shares more.

On Friday, October 23, a group calling itself Scarlett Group put vinsolutions.com on its leak site. By Monday morning Cox Automotive had confirmed it was looking into suspicious activity tied to VinSolutions, the CRM that a lot of franchised stores run their sales floor on. Every dealer on that platform is asking the same question this week. Are we in it?

Fair question. For most of you, nobody can answer it yet. Cox included. I posted a short take on LinkedIn when the news broke, and this is the longer version: what’s confirmed, what’s still a claim, and what I’d do at a store over the next few days while the facts come in. It’s the same work our dealership cybersecurity services team runs for clients any time a vendor shows up in the news. None of it depends on Cox finishing its investigation first.

One note on the word “breach.” Cox hasn’t used it. I’m using it because it’s what everybody is typing into Google, not because the facts are in.

What Cox Automotive Has Confirmed, and What’s Still a Claim

Cox’s statement went to CDG News on October 26. A spokesperson said the activity “was quickly contained, did not involve any encrypting malware, and there was no disruption to our customers’ ability to use VinSolutions,” and that Cox is working “with outside cyber experts to determine the nature and scope of any data that was involved” (CDG News, October 26, 2026). VinSolutions is the only Cox platform affected. Cox believes a limited subset of dealers was involved and says it will notify them directly (Auto Remarketing, October 26, 2026).

Everything else floating around is a claim. Here’s how I’d sort it.

CBT News put the group’s claims next to Cox’s statement and was careful to say the claims are unverified (CBT News, October 27, 2026). You’ll also see user counts and password totals from credential-monitoring firms making the rounds. Those are claims too. I’m leaving the numbers out until Cox confirms something, and I’d suggest your managers do the same when customers ask.

To be fair to Cox, a fast statement that says what’s known and what isn’t is exactly what you want from a vendor in the first few days. Any vendor can be hit. Dealers learned that in 2024, and I wrote last December about why CDK wasn’t a one-time wake-up call. The difference this time, at least by Cox’s account, is that nobody’s sales floor stopped.

Confirmed and claimed are two different columns. Keep them that way.

Why a CRM Incident Reaches Your Store When It Didn’t Happen at Your Store

A vendor security incident is an attack on a company that holds or handles your data for you: your CRM, your DMS, your credit-application provider. Your own network can be completely clean and your customers’ information can still be exposed, because the records sit on the vendor’s systems and your people log in there every day.

Think about what lives in a dealership CRM. Every lead, phone number, and home address. Trade-in details. Notes from the desk. Depending on how your store is set up, maybe a credit application or a copy of a driver’s license. And every salesperson, BDC agent, and manager has a login, which is its own kind of data, because a lot of people reuse passwords. That’s a real problem when a password list shows up on a leak site, whether or not the leak turns out to be real.

If I ran a store, the connections would bother me more than the records. Your CRM is probably wired into the DMS, your desking tool, and digital retail, plus the phone system and a few lead providers. Each of those links runs on an integration account or an API key that got created on some vendor’s onboarding call, back when the old sales manager was still there, and it hasn’t been touched since. Who owns that list at your store? In a lot of dealerships the honest answer is nobody. I don’t say that as a knock on anyone. These connections pile up one vendor demo at a time, and nobody ever schedules a meeting to take one away.

Your data lives in more places than your building.

What to Do This Week

None of this needs Cox’s final report, and most of it takes an afternoon if one person at the store owns it.

• Start with an email to your Cox Automotive representative asking whether your store is in the affected group, which is the same first move CBT News suggested, and ask for Cox’s incident statement in writing while you’re at it. File whatever comes back where you’ll find it next spring.
• Reset VinSolutions passwords for every user, and do the managers and admin accounts first because those can see the most. While you’re in there, check that multi-factor authentication is on for every login. Every one, not most. The FTC Safeguards Rule already requires MFA for anyone accessing an information system that holds customer information (16 CFR 314.4(c)(5)), and CISA’s MFA guidance is a plain-English place to start if your staff push back.
• People reuse passwords. You know it and I know it, so anybody whose CRM password also opens their email, their bank, or their kid’s soccer league account should change it there as well. Say it out loud at the sales meeting.
• Next, the connections. Get the list of every app tied to your CRM, rotate the keys on the ones you still use, and switch off anything nobody at the store can explain. Then ask those vendors whether Cox has told them anything.
• Expect phishing. After a public incident, an email that looks like it’s from Cox or VinSolutions asking someone to “confirm your account” is the predictable next move. Tell the sales floor today, before it lands.
• Former employees are the quiet risk here. A salesperson who left in the spring and can still get into the CRM goes near the top of your list, right after that email to Cox.
• Keep notes as you go. Date, who you asked, what they said, what you changed. Ten minutes of typing, and it becomes the store’s record of how it responded.

One thing I wouldn’t do yet is send customers a notice of your own. Not until you know whether your store’s data was involved, and not without your attorney. A premature letter about a breach that turns out not to touch your customers creates its own mess.

Waiting on Cox is fine. Waiting to change your passwords isn’t.

Where the FTC Safeguards Rule Fits

Here’s the part some dealers don’t expect. The Safeguards Rule doesn’t stop at your own network. Not even close. Section 314.4(f) gives you three duties with every service provider that touches customer information: pick ones “capable of maintaining appropriate safeguards,” require those safeguards “by contract,” and periodically assess them “based on the risk they present and the continued adequacy of their safeguards” (16 CFR 314.4). The FTC’s June 2025 Safeguards FAQ for auto dealers puts it more bluntly: when you give a provider access, “you must monitor the safeguards that service provider uses to protect that information.”

So the record from the last section isn’t busywork. It’s vendor oversight, written down.

Then there’s notification. Since May 2024, the rule has required a dealership to notify the FTC within 30 days of discovering an event that involves the unencrypted information of at least 500 consumers. Whether an incident on a vendor’s system starts your own clock isn’t spelled out in the FTC’s dealer FAQ, and the answer depends on facts nobody has yet: whose customers, what data, encrypted or not. That’s a question for your attorney and your Qualified Individual, and state breach laws can add requirements of their own. Ask early. We walk through how the federal piece works in our guide to Safeguards Rule breach notification.

Waiting for the vendor’s next press release isn’t a plan. Nobody does compliance that way.

Vendor Oversight Is a Standing Job

Here’s my honest read. Most dealerships look hard at a vendor twice: when they sign the contract, and when the vendor’s name is in the news. The rule says periodically. That word matters. It doesn’t mean once every few years when something goes wrong.

Our compliance program includes a vendor risk rating for exactly this reason. We pull a client’s vendors into one place, ask each one how it handles the store’s data, and rate what comes back. Some vendors hand over a security statement the same day. Others take weeks, or won’t put their practices in writing at all. Both answers tell you something. Across the 2,000-plus dealerships we’ve supported over nearly 30 years, we’ve already seen this exact problem more times than I can count: the vendor list nobody owns, and the integration nobody remembers approving. It shows up with AI tools now too, which is why we wrote a separate AI vendor risk assessment for dealerships, and it showed up earlier this year with the CarGurus breach.

VinSolutions will drop out of the headlines. Your vendor list won’t shrink.

What Dealers Are Asking This Week

What Stays After the News Cycle

A week from now there’ll be a new headline and most stores will move on. That’s normal. The ones that come out ahead are the ones that used this week to find out who has their data and who can log in to it. If you’d like an outside look at your own vendor list, your logins, and the integrations nobody remembers, start with our complimentary IT and cybersecurity assessment.

Know your vendors before their name is in the news.