VinSolutions, a customer relationship management platform used by car dealerships and a Cox Automotive business, has been named on a ransomware group’s leak site. The claim is unconfirmed, and this page will be updated if the company or regulators release more information.
VinSolutions’s Data Breach Investigation
VinSolutions provides software that car dealerships use to manage sales leads, track customers and follow up on deals. It is part of Cox Automotive, one of the largest companies serving the automotive retail industry. Because the platform sits in the middle of the dealership sales process, it can hold records that belong not to VinSolutions itself but to the many dealerships that rely on it and to the shoppers and buyers those dealerships serve.
In October 2026, a ransomware group calling itself Scarlett Group listed vinsolutions.com as a victim on its dark web leak site. Ransomware tracking site Ransomware.live recorded the listing on October 23, 2026, and describes the group as a newly active gang whose claims should be treated with caution until they are independently verified. Attorneys working with ClassAction.org have said they are investigating the claim.
As of this writing, VinSolutions has not publicly confirmed that it suffered a breach, has not described how any intrusion may have happened, and has not said whether any customer information was taken. No notice letter to affected people and no filing with a state attorney general has been located. For that reason, everything on this page about the incident is a claim reported by outside sources, not an established fact.
A separate dark web monitoring service reported that a threat actor on an underground forum claimed to have exposed customer and deal records from VinSolutions, which the alert describes as a major automotive dealer CRM platform. According to that alert, the claimed material includes Social Security numbers, driver’s license numbers and images, dates of birth, banking and income details, credit applications, CRM conversations and staff account data. The monitoring service says it does not buy or verify such data, and it is not clear that the forum claim and the leak-site listing describe the same event.
If the claims turn out to be accurate, the number of people affected could be large, because a single CRM platform can serve many dealerships at once. The details that car buyers share during a purchase or financing application are exactly the kind of information identity thieves look for. A credit application may include an applicant’s full name, address, employer, income and Social Security number, and a driver’s license image can be used to impersonate someone in person or online.
Ransomware groups typically steal files first, then post the victim’s name on a leak site and demand payment, threatening to publish what they took if the demand is refused. A listing on a leak site is a claim by criminals, and such claims are sometimes exaggerated or wrong. At the same time, the posting of a company’s name is often the first public sign that something happened, and confirmation from the company can follow days or weeks later.
State breach notification laws generally require an organization to notify affected individuals after it determines that personal information was acquired without authorization. That obligation is triggered by the organization’s own investigation, not by the attacker’s announcement, which is why a leak-site claim can appear well before any official notice. When a service provider is involved, the notice may come from the dealership a person actually did business with rather than from the software company, so people who bought or financed a vehicle should watch for mail from either one.
Automotive retail has become a regular target for cybercriminals because dealerships and their software vendors combine personal identity details with financial information in one place. A problem at a single vendor can ripple across many dealerships at once, as the industry saw in earlier disruptions to dealership software providers. Customers rarely know which vendors hold their data, which makes it hard to judge their own exposure without an official notice.
Attorneys are looking into whether VinSolutions maintained reasonable safeguards for the sensitive customer information that flows through its platform, including how that information was stored, how access was controlled and monitored, and whether stronger protections could have prevented or limited any exposure. If you purchased, leased or financed a vehicle and later received a notice mentioning VinSolutions or Cox Automotive, keep it, because it may include enrollment codes and deadlines for protection services.
When Did This Breach Occur?
A leak-site listing for VinSolutions was recorded on October 23, 2026, and the group behind it describes the attack as part of activity in October 2026. VinSolutions has not publicly stated when any unauthorized access began or ended, when it may have discovered a problem, or whether it plans to notify anyone. Until the company or a regulator provides dates, the timing of any incident should be treated as unconfirmed.
What Information Was Breached?
VinSolutions has not confirmed what information, if any, was involved. A dark web monitoring alert describes a forum claim that includes Social Security numbers, driver’s license numbers and images, dates of birth, banking and income details, credit applications, CRM conversations and staff account data. That list is an unverified claim from a threat actor. It should not be read as a confirmed description of what was taken, and no total number of affected people has been published.
What You Can Do
If you received a notice related to VinSolutions or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Watch for a notice from VinSolutions, Cox Automotive or a dealership where you bought, leased or financed a vehicle, since the company that sends it may not be the software provider.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against VinSolutions
If you bought, leased or financed a vehicle from a dealership that uses VinSolutions, or you received a notice about this incident, you may have legal options for holding the company accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
