Cox is investigating a break-in at VinSolutions, a judge keeps the dealers' Scout case going, and two dealers are paying real money to train more technicians.
The company that holds your customer records had a bad weekend, and your store may be part of it.
On Friday, October 23, a group calling itself Scarlett Group posted online that it had broken into VinSolutions, the customer records system Cox Automotive sells to dealers. On Monday, Cox confirmed it is investigating. It says a limited group of dealers was affected. It has not said which ones or what was taken.
Two other items from the same days point the same way. A federal judge in California kept the dealers' case against Scout and Volkswagen alive. And dealers talking about the technician shortage put real money on the table to fix it.
The big picture: your bargaining power sits in three places. Who holds your customer records. Who gets to sell the car. Who can fix it in your shop. All three were in the news in four days, and in each one a dealer had less control than you would assume.
The dealer principal asks the Cox representative, in writing today, whether the store is in the affected group.
Whether Cox tells dealers how many were affected and what records were involved. Until it does, treat the hacking group's claims as unproven and Cox's reassurance as incomplete.
The hacking group's claim was posted on Friday, October 23. According to CBT News, the group says it holds customer records, including Social Security numbers, driver's license numbers and credit applications. A security site that reported it labeled the claim unverified. The group is described as newly active, so treat its claims with caution.
Cox's own statement, reported by Auto Remarketing on October 26, says the activity was limited to VinSolutions and was contained quickly. It says no data-locking software was used and dealers could keep working. Cox says it will notify affected parties directly. It has not said how many dealers or customers are involved. A law firm page cited by CBT News says attorneys are looking at a possible class action.
The first public word came from a hacker's website, not from your vendor. That is the part to fix in your contract. Whatever the final facts are, you need a promise about how fast you hear.
Ask Cox, in writing, whether your store is affected. Then ask your lawyer who must notify your customers if your records were involved.
Make every VinSolutions user change their password and turn on two-step login. HookPhish, a site that tracks these claims, notes that most break-ins start with a stolen password or a phishing email.
On October 22, Chief Judge Cynthia Bashant of the Southern District of California denied motions from Volkswagen and Scout to end the California New Car Dealers Association's lawsuit early. The suit rests on a 2023 state law, Assembly Bill 473, which bars automakers from competing with their own dealers. The court kept its reading of the phrase "indirectly through an affiliate." That is the phrase the dealers say covers selling Scout vehicles through a separate company. The case now moves to discovery, and a March 30 ruling went the dealers' way too.
Dealer attorney Len Bellavia cautions that this is the "second inning" of a nine-inning game. The court has not decided whether Scout and Volkswagen are connected enough to break the law.
The real fight is not Scout. It is whether any automaker can open a second company and sell around its own dealers. If the answer is yes, your store becomes a place that delivers and services cars someone else sold. My bet: within two years at least one other automaker tests the same structure, whichever way this case lands. I am wrong if the courts shut it down quickly.
Read your franchise agreement for anything on separate sales companies, and ask your state dealer association whether it is tracking a similar case.
Most shop software sells you more appointments. The limit is how many certified technicians you have. Two dealer operators laid out the numbers in coverage of a Digital Dealer session, reported on October 25.
Jennifer Briggs, general manager of Volkswagen of Marion in Illinois, plans a second shift in the first quarter. Apprentices and master technicians would work evenings on internal jobs. That frees daytime bays for customer-pay and warranty work. She estimates it could add $1.8 million in service revenue in 2027, and calls that conservative. It is her projection, not a result.
LaFontaine Automotive Group built an 18-month apprenticeship. When an apprentice finishes with six to eight certifications, the mentor gets $15,000 and the apprentice gets a $2,500 toolbox. Fixed operations director Steven Parks says paying certified technicians time and a half on warranty work costs the group about $3 million a year. Separately, Cox Automotive is running a trial that gives students at one Alabama community college free use of its Xtime service software.
Most pay plans reward the technician who bills the most hours, not the one who trains someone. Until that changes, mentoring loses to flagging hours.
Find the instructors at the schools within 30 miles and call them directly, as Briggs advises.
Price a mentor bonus against the open bay you are paying for today.
Cox Automotive's weekly summary of October 26 puts the typical interest cost on a new-vehicle loan at $10,100, up 79 percent since 2019. For used vehicles it is $10,900, up 96 percent. The price of the vehicle alone is up about 30 percent. Counting price and interest together, Cox says new is up 37 percent and used is up 43 percent. The summary notes the 10-year Treasury yield is near 5 percent. It does not explain how it defines "typical."
The monthly payment is a fixed room, and interest now takes a bigger share of it. Every product the finance manager adds competes with that interest for the same room. A store that treats this as a rate story and not a payment story will lose the product sale before the customer sits down.
Show the payment with and without each product before the customer asks, and track how often products come off the deal.
LaFontaine Automotive Group, with more than 40 stores in Michigan, agreed to install UVeye scanners at all its locations, per a WardsAuto column on October 26. A car drives through a tunnel, and cameras produce a condition report on the underbody, tires and exterior. The column says technicians still diagnose and repair. It reports no results, and UVeye says about 1,000 units are in use in the U.S.
The limit is the same one as story 3: a scan that finds six repairs needs technician hours to sell them. Start with a person checking a sample of scans against what the technician finds. Early sign: more repairs found per car. What really counts: more repairs sold and completed, compared with a store that is not using it. Keep the scan with the repair order, so you can show a customer what was found and when.
Ancira Auto Group, with 14 stores, says disconnected data is a main obstacle to getting value from AI. April Ancira told CBT News the group cleans customer data with Fullpath. It cannot always push the cleaned records back into its dealer management system, which comes from CDK. Duplicate phone numbers and old contact details weaken any tool built on top. At an October 22 panel, Cox's Marianne Johnson put it bluntly: "Disconnected data just automates the wrong answer faster."
To make a new tool work, a store needs one clean customer record, permission to write it back, and a named person who owns it. The AI is the cheap part. The cleanup is the cost.
The question for your vendor: can cleaned records go back into my system, and what do you charge each time?
The dealer principal hands the head of technology a one-page list by Friday.
It names every vendor that holds customer records, the breach-notice terms in each contract, and one contact who answers. Count how many vendors have no written deadline for telling you. Stop when the list is finished and the gaps are in front of the lawyer. I am wrong about the priority if Cox shows that the affected group is small and the records involved are minor. Even then, the list is worth having.
If a vendor you pay every month lost your customers' credit applications tonight, would you hear it from them first, or from a hacker's website?