VinSolutions Data Breach: What's Confirmed and What Dealers Owe

On October 26, 2026, Cox Automotive confirmed that someone got into VinSolutions, the CRM that about 7,000 dealerships use to work leads, follow up with customers and track deals. Cox says it contained the activity quickly, the system never went down, and only "a limited subset" of VinSolutions dealers was affected. It hasn't said which dealers, how many customers, or what data was involved.

That last part matters most, because the customer records in a CRM belong to the dealership, not the software company. If your customers' information was taken, the duty to tell the FTC, your state and your customers may fall on your store. Those deadlines can start when you find out, not when Cox finishes its investigation.

This guide covers what Cox has confirmed, what is only claimed, how to read the numbers going around, what a dealer may owe, and what to do this week, whether you run VinSolutions or another CRM.

Note: AutoDealer.io makes dealer software too, a CRM included. We're not writing this to pile on. It could happen to any vendor, ours included, and everything below applies whoever holds your data. This is general information, not legal advice, so talk to your attorney about your own store. Last reviewed November 8, 2026. We'll update it when Cox says more.

What happened, day by day

What Cox has confirmed

Cox sent its full statement to Auto Remarketing. Here is what it says:

• The activity was limited to VinSolutions. No other Cox Automotive product or platform was affected.
• It was quickly contained and involved no encrypting malware, so dealers never lost the use of the system.
• Cox is working with outside cybersecurity experts to find out "the nature and scope of any data that was involved."
• Based on its investigation so far, Cox believes a limited subset of VinSolutions dealers was affected, and it will notify the affected parties directly.

NIADA added one detail after talking with Cox: Cox intends to help affected dealers with the regulatory and privacy notices that may follow.

"No encrypting malware" is good news for your daily operations. This wasn't a repeat of the June 2024 CDK Global attack, when ransomware took down the DMS at roughly 15,000 dealerships for about two weeks. But it says nothing about whether files were copied. Some groups don't bother locking up systems at all. They copy the data and threaten to publish it, and the note Scarlett Group posted reads that way: it says the data stays in the group's hands until a negotiation deadline passes.

What has been claimed, and not confirmed

The leak site listing. Scarlett Group says it breached VinSolutions. Ransomware.live describes the group as newly active and says its claims should be treated with caution until someone checks them.

The forum post. According to Darkwiser, a seller claims to have Social Security numbers, driver's license numbers and license images, dates of birth, banking and income details, credit applications, CRM conversations and staff account data. Darkwiser labels the claim unverified, and the post gives no record count.

Cox has confirmed none of it. No data types, no record count, no list of dealers.

Treat that list as the worst case, not as the facts. It's still worth planning for, though. If fields like those were taken, nearly every breach notice law in the country applies.

What the "214 users" figure really means

Some coverage said the attack compromised the data of 214 VinSolutions users. That's not what the number measures.

It comes from a Hudson Rock panel on the Ransomware.live listing. Hudson Rock tracks infostealers, malware that copies saved passwords off infected computers. For vinsolutions.com, the panel shows 214 compromised users, 0 compromised employees and 5 third-party employee credentials. A second panel, from ParanoidLab, shows 1,859 exposed passwords (55 marked critical) and 105 browser cookies.

Those are VinSolutions logins, which in practice means dealership staff, that have turned up in stolen-password logs. They aren't a count of victims of this incident, and they aren't customer records. Nobody has said those logins were how the attackers got in.

They're still worth your attention, because they show how break-ins like this usually start. A salesperson saves the CRM password in the browser on a home laptop. The laptop picks up malware from a download or a bad link, and the saved password ends up for sale. HookPhish, one of the sites that logged the listing, noted that most ransomware intrusions start with a stolen password or a phishing email. Two-factor sign-in is the control that makes a stolen password useless on its own.

Why this lands on the dealer, not only on Cox

Your customer records are still yours

Under the FTC Safeguards Rule, a dealership that arranges financing or leases is a financial institution. The rule defines customer information as records "handled or maintained by or on behalf of" your business (16 CFR 314.2). Records you keep in a vendor's system are kept on your behalf. The vendor is your service provider, and overseeing it is part of your job under the rule.

The FTC report: 500 consumers, 30 days

If unencrypted customer information about at least 500 consumers was acquired without authorization, you must report it to the FTC as soon as possible, and no later than 30 days after discovery, on the FTC's online form. Three details catch dealers out:

1. Access counts as taking. If someone got into unencrypted customer information, the rule presumes they took it, unless you have reliable evidence they didn't or couldn't have.
2. The clock is yours. The event counts as discovered on the first day it's known to you, and you're treated as knowing whatever any of your employees, officers or agents know. Nothing in the rule waits for a vendor's forensic report.
3. It's public. When it adopted the requirement, the FTC said it intends to enter these reports into a publicly available database.

If your store keeps customer information on fewer than 5,000 consumers, the rule doesn't require a written incident response plan (16 CFR 314.6). The FTC report and two-factor sign-in still apply to you.

State laws: the vendor tells you, you tell your customers

State breach laws mostly work the same way. A business that keeps data for someone else has to tell the owner. The owner notifies the people affected, and often the state attorney general too. The deadlines follow where each customer lives, not where your lot is, so a store that sells across state lines can have several clocks running. Three examples:

Each state starts its clock a little differently and allows some delays, for law enforcement or to work out the scope, so check the statute or ask counsel. Two details stand out. Florida lets a vendor send the notices for you, but if those notices are wrong, the violation counts against your business. California spells out the notice's title, "Notice of Data Breach," and its headings, so one national letter may not satisfy it.

What was taken decides which duties apply. State laws are usually triggered by a name together with something like a Social Security number, a driver's license number or an account number. The FTC report covers a wider set of customer information from financing and lease deals. And a few states exempt businesses already covered by federal financial privacy rules. The Minnesota Automobile Dealers Association says Minnesota's breach law doesn't reach dealers that provide financing. This is why the first question for Cox is exactly which fields were involved.

What happened last time: the 700Credit breach

The best guide to how this may play out is the last big breach at a dealer vendor. On October 25, 2025, 700Credit found that attackers had gotten into 700Dealer.com, its web app for dealers, and copied names, addresses and Social Security numbers from consumer activity between May and October 2025. It told dealers on November 21. According to 700Credit, nearly 18,000 dealerships and roughly 5.6 million consumers were in the data.

What followed is a useful preview:

• One FTC filing for everyone. NADA asked the FTC to let 700Credit file a single consolidated notice on behalf of its affected dealers, and the FTC agreed. Dealers who didn't opt out had no separate FTC filing for that incident, MADA reported.
• State duties stayed with each dealer. 700Credit offered to send state and consumer notices for dealers, but advisers reminded dealers that the duty under each state's law was still theirs.
• The fine print mattered. Dealer compliance advisers pointed out that 700Credit's sample letter didn't name the dealership, and that the consolidated FTC filing would list dealer names on a public website.

If Cox makes a similar offer, it could save you a lot of work. Read it before you accept: which notices it covers, which states, whether the letters carry your store's name, and who is on the hook if a deadline slips.

If you use VinSolutions: what to do this week

Find out where you stand

• Ask Cox in writing whether your store is in the affected group, and save the reply with its date. No answer is not the same as no.
• Write down the day you first knew. Your FTC and state deadlines may run from it.
• If you're affected, get specifics in writing: which fields, how many customers, which states they live in, what date range, whether the data was encrypted, and whether old customers and unsold leads are included along with current deals.
• Ask which notices Cox will handle (the FTC report, state attorneys general, customer letters, credit monitoring). Ask for the sample letter, check that it names your store, and check it against each state your customers live in.

Lock down logins today, affected or not

• Reset every VinSolutions password at your store and end any sessions still signed in.
• Turn on two-factor sign-in for every user. The Safeguards Rule requires multi-factor authentication for anyone who accesses a system holding customer information, unless your Qualified Individual approves an equally strong control in writing.
• Remove anyone who has left. Compare the user list against payroll, not against memory.
• Check the tools connected to your CRM. Lead providers, chat tools and other integrations often sign in with their own credentials. Ask each one whether it has heard from Cox.
• Tell staff not to save work passwords in the browser on a personal computer.

Get ready in case you're affected

• Tell your Qualified Individual, the person who runs your security program, and write the incident up. If your store keeps information on 5,000 or more consumers, your written incident response plan applies.
• Call your cyber insurer early. Many policies set a deadline to report an incident and require their approved lawyers and forensic firms.
• Tell IT and your vendors to stop anything that auto-deletes CRM logs, email, call recordings or texts.
• Pull your VinSolutions contract. Find out how fast Cox must tell you about an incident, who pays for notices and credit monitoring, and the cap on what Cox can owe you.
• Warn your team and your customers about follow-up scams. A CRM holds names, phone numbers, vehicles and deal history, which is exactly what a convincing fake payoff, refund or recall message needs. Tell customers you will never ask for a Social Security number or a bank login by text.

If you run a different CRM

The lesson isn't about one product. Your customer data sits with several vendors at once: the CRM, the DMS, the credit pull service, e-signature, your website's lead forms, texting, the F&I menu. 700Credit and now VinSolutions show how a breach at one of them turns into a notice problem for the dealer. The Safeguards Rule already asks you to pick vendors that can protect the data, require that protection in the contract, and check on them from time to time (16 CFR 314.4(f)).

An afternoon is enough to get ahead of it:

• List every vendor that holds customer information, with a contact you can reach after hours.
• For each one, check that every user at your store has two-factor sign-in turned on.
• Read how fast each contract says the vendor will tell you about an incident, and who pays for notices.
• Decide who at your store opens an incident and calls the insurer.
• Keep less. The rule asks you to dispose of customer information within two years after you last used it, unless you need it for business or the law says to keep it. Data you no longer hold can't be stolen.

We covered the full set of requirements in Dealer Data Security: What the Law Actually Requires, and why encrypted data that's stolen without its key usually doesn't trigger the FTC report in Dealership Data Encryption: How It Works and Why It Matters. If stolen identities start showing up at your desk as credit applications, the FTC Red Flags Rule guide covers what to check.

How AutoDealer.io handles customer data

We're a vendor too, so here is what AutoDealer.io's dealer data security covers, limits included. Each dealership's records are kept apart from every other dealer's by the database itself. Customers' dates of birth and driver's license numbers, and the answers shoppers give on your website's lead forms, are encrypted before they're saved. The app has no field for a Social Security number at all, and the financing form on your website doesn't ask for one.

Every user can turn on two-factor sign-in with an authenticator app, and deactivating someone who leaves signs them out everywhere. Two-factor is each person's own choice today, so an owner can't require it for the whole team. Owners and admin managers can search an audit log of recorded changes. None of this is a guarantee against incidents, and it doesn't protect your own computers, email or network.

Frequently asked questions

Was VinSolutions hacked?

Cox Automotive confirmed on October 26, 2026 that it detected and contained suspicious activity on VinSolutions that affected a limited subset of its dealers. A ransomware group called Scarlett Group claimed the attack on October 23. Cox hasn't confirmed the group's claims or said what data was involved.

What data was taken in the VinSolutions breach?

That hasn't been confirmed. A dark web listing claims Social Security numbers, driver's license numbers, dates of birth, banking and income details, credit applications and CRM conversations, but monitoring services label it unverified, and Cox hasn't confirmed any data types or a record count.

How do I know if my dealership was affected?

Cox says it will notify affected dealers directly. Don't wait for that. Ask your Cox Automotive representative in writing whether your store is in the affected group, and keep the dated answer.

Does a dealer have to notify customers when a vendor is breached?

Usually, yes. State breach laws put the duty to notify affected people on the business that owns the data, and for customer records in a CRM that's the dealership. The vendor's duty is to tell the dealer. A vendor can send the notices for you, but in states such as Florida, mistakes in those notices count against the dealer.

When does a dealership have to report a breach to the FTC?

As soon as possible and no later than 30 days after discovery, when unencrypted customer information about at least 500 consumers was acquired without authorization. The report goes through the FTC's online form, and the FTC has said it intends to make the reports public.

Will Cox file the FTC report and send letters for dealers?

NIADA says Cox intends to support affected dealers with the regulatory and privacy notices that follow. After the 700Credit breach, the FTC let that vendor file one notice for all of its affected dealers. Get Cox's offer in writing and check exactly which notices it covers.

I bought a car from a dealer that uses VinSolutions. What should I do?

Watch for a letter from the dealership or from Cox. In the meantime, you can place a free credit freeze with Equifax, Experian and TransUnion, check your credit reports, and be careful with calls or texts that mention your car or loan and ask for personal or payment details.