Dealership Tech Pro · FTC Safeguards
When Your CRM Vendor Gets Breached, You're Still the One Holding the Data
Last week, one of the biggest names in dealership software had a security scare. The detail that matters for a store is less the headline than who holds the data.
What Cox has confirmed so far
Cox Automotive, which owns the VinSolutions CRM, said on October 26 that it was working with outside cyber experts on suspicious activity, that the activity was “quickly contained,” and that a limited subset of dealers appears to be affected. It had not yet determined the full scope of any data involved. A ransomware group has claimed it stole data, but Cox has not confirmed that claim.
Why a vendor's problem lands on the dealer's desk
Under the FTC Safeguards Rule, a dealer's customer data is the dealer's responsibility, including when a vendor holds it, and the rule expects you to oversee service providers by contract. If a breach involves the unencrypted information of 500 or more consumers, you must notify the FTC no later than 30 days after discovery.
Most of the coverage will wait on Cox's final word on scope. I think that misses the practical point. Big or small, an incident like this tends to expose the same gaps at the store level: logins still active for people who have moved on, customer databases protected by a password alone, and vendor contracts whose breach-notification clause nobody has read. Whether a store is on VinSolutions or not, those are the questions its own vendors would raise on a bad day, and a dealer who can answer them quickly is in a very different position from one who has to go looking. This is general information, not legal advice.
Get a free Technology Review
A vendor breach is a vendor problem until you find out nobody at your store knows who has access to the data. Dealership Tech Pro reviews your phones, internet, software and vendor contracts, then shows you where the money and the gaps are. Book a free 30-minute Technology Review, take the 3-minute Readiness Check, or call 707-695-9500.
Frequently asked questions
Are car dealerships responsible when a CRM vendor has a data breach?
Under the FTC Safeguards Rule, a dealership is responsible for protecting its customers' information, including when a third-party service provider handles it. Dealers must select capable providers, require safeguards by contract, and periodically assess them. What a vendor owes you after a breach depends on your contract.
Do auto dealers have to report a data breach to the FTC?
In some cases. If a breach involves the unencrypted information of at least 500 consumers, the Safeguards Rule requires notifying the FTC as soon as possible and no later than 30 days after discovery.
What is the FTC Safeguards Rule for auto dealers?
A federal rule that treats dealers as financial institutions and requires a written information security program, including a Qualified Individual, a written risk assessment, multi-factor authentication, encryption, service provider oversight and an incident response plan.