Cox Automotive has confirmed suspicious activity on its VinSolutions dealer CRM, days after a new extortion crew called ScarlettGroup put the platform on its leak site. The same group claims the mid-October intrusion at contact-centre giant Genesys, and the two incidents together point to a crew that goes after the vendors holding everyone else’s customer data.
What happened
On 26 October 2026, Cox Automotive told trade press that it was working with outside cyber experts to investigate suspicious activity tied to VinSolutions, the customer relationship management platform it sells to car dealerships. Auto Remarketing has reported that about 7,000 dealerships use it. A Cox spokesperson said the activity had been contained quickly, did not involve encrypting malware and had not stopped dealers using the service. The company believes only “a limited subset” of dealers were affected and has promised to notify them directly. It has not said what data was involved.
Cox’s statement came three days after ScarlettGroup listed VinSolutions on its leak site on Friday 23 October. According to dark web monitoring service Darkwiser, the group claims to hold customer records including Social Security numbers, driving licence numbers and credit applications. Cox has confirmed none of that, and both Darkwiser and Ransomware.live describe the claims as unverified.
VinSolutions is not the group’s first well-known target. Genesys, whose contact-centre software is used by more than 8,000 organisations worldwide, says it learned on 16 October that an unauthorised third party had got into some of its internal systems, among them a CRM and a learning management system (LMS). In its statement, first published on 19 October and updated on 23 October, Genesys confirmed that information in both systems was accessed or downloaded. That information includes customer names, business email addresses, phone numbers, job titles, company and account details, plus other information tied to customer interactions. ScarlettGroup has claimed that attack too, though Genesys has not named an attacker.
The technical picture
Genesys says its customer-facing products, Genesys Cloud, Genesys Engage and Genesys Engage Cloud, were not compromised. It also says no one accessed customer environments or the data processed inside them, including call recordings and analytics. The breach was on the corporate side: the systems a vendor uses to train people and manage its sales relationships. The affected LMS has been switched off.
At Cox, the absence of encryption and the lack of any outage fit what ScarlettGroup appears to be: a crew that steals data and threatens to publish it, rather than one that locks up systems. Text from the attack, shown in a leaked image described by CDG News, tells the victim that the data will stay in the group’s hands “until the negotiation deadline has passed”.
There is also a credential angle. The VinSolutions leak-site entry carries infostealer snapshots attributed to Hudson Rock and ParanoidLab. According to CDG News, these suggest that 214 VinSolutions users and roughly 1,859 passwords were exposed. Ransomware.live’s entry for Genesys also flags infostealer activity against that company’s domain. Neither company has said how the intruders got in, and Cox has not confirmed those figures. But stolen session cookies and saved passwords from infected staff or partner devices remain one of the cheapest ways into SaaS platforms. If those snapshots are accurate, they are the first place I would look.
Breachsense has recorded six ScarlettGroup victims since 8 October: Yale University Press, a regional government domain in India, Genesys, NBCUniversal, VinSolutions and Malaysia’s Mah Sing. Only the Genesys and Cox incidents have been acknowledged; the rest remain claims.
Why it matters for UK organisations
VinSolutions is mainly a US dealer product, so the direct UK exposure there looks limited. Genesys is a different matter. With more than 8,000 customer organisations worldwide, many UK contact centres in banking, retail, utilities and the public sector are likely to be among them. The stolen CRM data is exactly what a phishing crew wants: who your contact-centre lead is, their direct line, their job title, which Genesys products you run and the history of your conversations with the vendor.
That is enough for a convincing email, sent to whoever holds admin rights over your telephony and customer data, about a “mandatory security update following the recent incident”. Genesys has warned customers to watch for suspicious messages that mention it, and says it will never ask for passwords through email or unsolicited channels.
There is a regulatory point too. Business contact details for named individuals are personal data under UK GDPR. Where a vendor holds them as a controller for its own sales purposes, the vendor carries the notification duty. But if your organisation shares staff data with suppliers, you should know which suppliers hold what, and your records of processing should show it.
Expert view
This is the third-party problem in a sharper form. Attackers have learned that breaking into one SaaS vendor’s back office can give them a map of thousands of downstream organisations. The products need not be touched: the CRM tells them who to target next and what story to tell.
In my experience, supplier risk reviews concentrate almost entirely on the product: where the data is hosted, what certifications the vendor holds, how tenants are kept apart. Very few ask how the vendor protects its own sales and training systems, even though those systems hold a detailed directory of the customer’s most privileged users.
The other lesson is about speed. ScarlettGroup appeared on trackers in early October and claimed half a dozen victims within three weeks, several of them household names. New crews make noise to build a reputation, so expect more listings, some exaggerated or false.
What to do now
- Brief your Genesys administrators and contact-centre managers today. Tell them that targeted phishing using real account details is likely. Any request to re-authenticate, change MFA or install software that mentions Genesys should be checked through a known contact, not the one in the message.
- Review privileged access on CX and CRM platforms. Check who holds administrator roles in Genesys Cloud, VinSolutions or similar tools, remove dormant accounts and enforce phishing-resistant MFA for admins. This maps to the Cyber Essentials user access control requirements.
- Hunt for infostealer exposure. Check breach and stealer-log feeds for your domains and your key suppliers’ domains. Revoke sessions and reset credentials for any staff whose devices appear, and make sure endpoint protection is running on contractor and BYOD devices that reach SaaS consoles (Cyber Essentials malware protection).
- Ask suppliers the back-office question. Add a question to vendor due diligence on how they secure their own CRM, support and training systems, and what customer data those systems hold about you.
- Prepare for unverified claims. Agree in advance who decides whether a leak-site listing that names you is real, how quickly you will say something, and when the ICO and affected individuals will be told.
Bottom line
Cox’s confirmation means ScarlettGroup has now claimed two intrusions at major customer-data vendors that the victims themselves have acknowledged, even if neither has named the attacker. The direct UK risk lies with Genesys customers, who should expect convincing, well-researched phishing aimed at the people who run their contact centres. Treat it as a live threat now, not when the next listing appears.
Sources
- CDG News: Cox Automotive confirms VinSolutions cyber incident, says activity contained
- CBT News: Hacking group claims data theft at VinSolutions, Cox investigating ‘suspicious activity’
- Genesys: Security Update: Incident Affecting Certain Genesys Internal Business Systems
- SecurityWeek: Genesys Hack Exposes Customer Data From Internal Systems
- Breachsense: SCARLETTGROUP Ransomware: Victims and Activity
- Ransomware.live: Victim genesys.com
