Cox Automotive confirms suspicious activity on VinSolutions dealership CRM after Scarlett Group data theft claim

Cox Automotive confirmed on Oct 26 2026 that it detected suspicious activity limited to VinSolutions, its CRM platform for car dealerships (used by about 7,000 dealerships, per Auto Remarketing). Cox says the activity was quickly contained, involved no encrypting malware and did not disrupt the service, that it is working with outside cyber experts, and that it believes a limited subset of VinSolutions dealers was affected and will notify them directly. The statement followed a listing by a newly active group calling itself Scarlett Group on its leak site on Oct 23, which claims customer records including Social Security numbers, driver's license numbers and credit applications. Cox has not confirmed those claims, the number of dealers or consumers involved, or what data was taken.

Why this severity: Cox confirms suspicious activity affecting a limited subset of dealers; the attacker's claims of SSNs, driver's licenses and credit applications are unverified, and no counts have been published

Started

Oct 23, 2026

• #Cox Automotive
• #Vinsolutions
• #Crm
• Data breach
• #Extortion