# Cox Automotive confirms suspicious activity on VinSolutions dealership CRM after Scarlett Group data theft claim · pwn.watch > Cox Automotive confirmed on Oct 26 2026 that it detected suspicious activity limited to VinSolutions, its CRM platform for car dealerships (used by about 7,000 dealerships, per Auto Remarketing). Cox says the activity was quickly contained, involved no encrypting malware and did not disrupt the service, that it is working with outside cyber experts, and that it believes a limited subset of VinSolutions dealers was affected and will notify them directly. The statement followed a listing by a newly active group calling itself Scarlett Group on its leak site on Oct 23, which claims customer records including Social Security numbers, driver's license numbers and credit applications. Cox has not confirmed those claims, the number of dealers or consumers involved, or what data was taken. Page: https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026 · generated 2026-10-30T18:57:08.978Z ## Status - Severity: medium · status: live · patch: partial - Product: Cox Automotive VinSolutions (dealership CRM) - Started: 2026-10-23 - Affected: VinSolutions dealership CRM (a limited subset of dealers, per Cox) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026.json - This file: https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: NIADA, the independent dealers' association, says Cox believes any data involved relates to a subset of VinSolutions customers and that Cox intends to support affected dealers with notification obligations. (https://niada.com/dashboard/vinsolutions-reports-security-incident-affecting-limited-number-of-dealerships/) - 2026-10-26: Cox Automotive confirms suspicious activity limited to VinSolutions: quickly contained, no encrypting malware, no service disruption; it believes a limited subset of dealers was affected and will notify affected parties directly. (https://www.autoremarketing.com/ar/technology/cox-automotive-spots-suspicious-activity-connected-to-vinsolutions-that-was-quickly-contained/) - 2026-10-23: A newly active group calling itself Scarlett Group lists VinSolutions on its leak site and claims to hold dealership customer records, including Social Security numbers, driver's license numbers and credit applications (unverified). (https://www.cbtnews.com/hacking-group-claims-data-theft-at-vinsolutions/) ## Fix brief # Security brief: Cox Automotive confirms suspicious activity on VinSolutions dealership CRM after Scarlett Group data theft claim Source: https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026 · status: live · severity: medium · updated Oct 30, 2026, 16:19 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Cox Automotive confirmed on Oct 26 2026 that it detected suspicious activity limited to VinSolutions, its CRM platform for car dealerships (used by about 7,000 dealerships, per Auto Remarketing). Cox says the activity was quickly contained, involved no encrypting malware and did not disrupt the service, that it is working with outside cyber experts, and that it believes a limited subset of VinSolutions dealers was affected and will notify them directly. The statement followed a listing by a newly active group calling itself Scarlett Group on its leak site on Oct 23, which claims customer records including Social Security numbers, driver's license numbers and credit applications. Cox has not confirmed those claims, the number of dealers or consumers involved, or what data was taken. Severity detail: Cox confirms suspicious activity affecting a limited subset of dealers; the attacker's claims of SSNs, driver's licenses and credit applications are unverified, and no counts have been published - Product: Cox Automotive VinSolutions (dealership CRM) ## Affected versions - VinSolutions dealership CRM (a limited subset of dealers, per Cox) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If your dealership uses VinSolutions, ask your Cox Automotive representative whether your store is in the affected subset, reset VinSolutions logins and review CRM integrations and API credentials. Consumers who bought or financed a car through a VinSolutions dealer should watch for a notice and consider a credit freeze if one arrives. Re-check Cox statements for confirmed data types and counts. ## Latest updates - Oct 27, 2026: NIADA, the independent dealers' association, says Cox believes any data involved relates to a subset of VinSolutions customers and that Cox intends to support affected dealers with notification obligations. - Oct 26, 2026: Cox Automotive confirms suspicious activity limited to VinSolutions: quickly contained, no encrypting malware, no service disruption; it believes a limited subset of dealers was affected and will notify affected parties directly. - Oct 23, 2026: A newly active group calling itself Scarlett Group lists VinSolutions on its leak site and claims to hold dealership customer records, including Social Security numbers, driver's license numbers and credit applications (unverified). ## Write-ups & news - [Cox Automotive spots 'suspicious activity' connected to VinSolutions that was 'quickly contained'](https://www.autoremarketing.com/ar/technology/cox-automotive-spots-suspicious-activity-connected-to-vinsolutions-that-was-quickly-contained/) - [Hacking group claims data theft at VinSolutions, Cox investigating 'suspicious activity'](https://www.cbtnews.com/hacking-group-claims-data-theft-at-vinsolutions/) - [VinSolutions Reports Security Incident Affecting Limited Number of Dealerships](https://niada.com/dashboard/vinsolutions-reports-security-incident-affecting-limited-number-of-dealerships/) --- Machine-readable: https://pwn.watch/i/cox-automotive-vinsolutions-dealer-crm-incident-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.