On the Dash:
- VinSolutions activity was quickly contained and affected a limited subset of dealers, Cox says.
- A hacking group claims data theft, which Cox has not confirmed.
- Law firms are seeking plaintiffs for a possible class action over the claims.
Cox Automotive said it detected suspicious activity on VinSolutions, its CRM platform for car dealerships, and quickly contained it. The company believes the incident affected a limited subset of VinSolutions dealers and is working with outside cyber experts to determine what data was involved, Cox said in a statement to Auto Remarketing.
The statement follows claims posted online Friday by a hacking group calling itself Scarlett Group. However, Cox hasn’t confirmed those claims, and they remain unverified.
The activity didn’t affect other Cox Automotive platforms, didn’t involve encrypting malware and didn’t disrupt dealers’ use of VinSolutions, according to the statement. Cox didn’t say how many dealers or consumers were affected or what information was involved, but the company did say it will notify affected parties directly.
Ransomware.live recorded Scarlett Group’s listing of VinSolutions on its leak site Friday, describing the group as newly active and saying its claims should be treated with caution until independently verified. Dark web monitoring service Darkwiser reported that the group claims to have customer records, including Social Security numbers, driver’s license numbers and credit applications. Notably, Darkwiser labeled the claims unverified and Cox hasn’t confirmed any data types or published a record count.
ClassAction.org posted a page Friday saying attorneys are investigating whether they can file a class action. The page asks affected employees, dealership customers and dealership staff to come forward and says the law firm Bryson Harris Suciu & DeMay PLLC sponsored the investigation.
Dealers that use VinSolutions should ask their Cox Automotive representative whether their store is in the affected group. When a software vendor is breached, dealerships may receive consumer notices, according to Settlement Insight. Auto Remarketing reported that about 7,000 dealerships use VinSolutions.