Cox Automotive this morning (Oct. 26) confirmed it is working with “outside cyber experts” to investigate recent suspicious activity tied to its VinSolutions platform.
“The activity was quickly contained, did not involve any encrypting malware, and there was no disruption to our customers' ability to use VinSolutions,” a Cox spokesperson wrote to CDG News via email. “Customers can continue to engage with all Cox Automotive solutions as they normally would.”
What this follows: Unconfirmed reports started circulating Friday (Oct. 23) on Ransomware.live and HookPhish after ransomware hackers with the Scarlett Group claimed to have breached the VinSolutions platform.
Allegedly, the attack compromised the data of 214 VinSolutions users.
That’s according to HudsonRock, a company that monitors corporate credential leaks and was credited with an “infostealer activity” snapshot on the ransomware blog.
A separate snapshot on the same blog, but from ParanoidLab, suggested that the attack exposed about 1,859 passwords.
Behind the hackers: A leaked photo showed text from the attack that read, in part, “We breached your organization and infrastructure! The data remains in our possession until the negotiation deadline has passed.”
The car business moves fast. Stay ahead.
The most important insights from automotive retail, delivered to your inbox daily.
Join 74,000 others now, it's free:
Another excerpt of the text read, “Didn’t see that coming, huh? Neither did your security team. But hey, nobody’s perfect, right?”
For now: The number of affected users and passwords remains unconfirmed.
However, the Cox spokesperson confirmed to CDG News that VinSolutions is the only Cox Automotive solution and/or platform affected by suspicious activity.
The Atlanta-based company said it is “working diligently with outside cyber experts to determine the nature and scope of any data that was involved.”
So far, they believe “a limited subset” of dealers on the platform were affected, and they plan to notify them.
“Our top priority is supporting our dealers' businesses and preserving the trust we've earned from them for decades,” the spokesperson added.
Bottom line: The HookPhish blog noted that “most ransomware intrusions start with a stolen password or a phishing email,” so dealerships and vendors should emphasize this across all staff so everyone understands the risks and how to prevent them.
A quick word from our partner
Sold-out model. Credit worry. A trade-in lead with a VDP link.
Impel AI doesn't reach for a script. It knows the customer, the vehicle, and your store, then answers like your best rep and keeps the deal moving. Read real dealership conversations across sales, service, financing, and trade-ins, start to finish. No scripts. Just the receipts.
