On Oct. 26, Cox Automotive confirmed it detected and contained suspicious activity within VinSolutions, the CRM platform used by roughly 7,000 dealerships to manage leads, deals and customer information. NADA has spoken to Cox Automotive, which said it is investigating what information was compromised and how many dealers were affected. Cox will notify dealers directly, as appropriate and consistent with its obligations, if its investigation identifies information belonging to its customers.
The Federal Trade Commission (FTC) Safeguards Rule requires financial institutions (including dealers) to provide an electronic notice to the FTC as soon as possible and no later than 30 days after discovering a notification event involving the information of at least 500 consumers’ sensitive nonpublic Personal Identifiable Information (PII). A notification event is the unauthorized acquisition of unencrypted customer information. Earlier this year, after discussions with NADA, the FTC updated its breach notification form to clarify that a third-party vendor can submit a notification on behalf of a financial institution.
In addition to federal requirements, state laws may also require dealers to notify state law enforcement, consumers, and consumer reporting agencies.
Cox Automotive has committed to staying in close contact with NADA and its dealer clients throughout the investigation. More information will be shared as it becomes available. We will coordinate with Cox Automotive and dealers if notifications are required. Dealers should promptly discuss these and other related legal considerations with their legal counsel.
More Information: