Cox Automotive VinSolutions, Honda investigate suspicious cyber activity

Cox Automotive confirmed Friday that it recently “detected suspicious activity” in VinSolutions, its CRM and sales software, while Honda said it is investigating a separate recent cybersecurity incident. Neither company provided dates of the incidents.

CBT News reported Oct. 27 that hackers, calling themselves Scarlett Group, posted “claims” involving VinSolutions online Oct. 23.

“However, Cox hasn’t confirmed those claims, and they remain unverified,” the article states. “Ransomware.live recorded Scarlett Group’s listing of VinSolutions on its leak site Friday [Oct. 23], describing the group as newly active and saying its claims should be treated with caution until independently verified. Dark web monitoring service Darkwiser reported that the group claims to have customer records, including Social Security numbers, driver’s license numbers, and credit applications. Notably, Darkwiser labeled the claims unverified, and Cox hasn’t confirmed any data types or published a record count.”

Honda confirmed to RDN that it recently experienced a cybersecurity incident involving its Interactive Network (iN).

“As a precaution, Honda temporarily took the iN offline to allow for a proper investigation and ensure the protection of our system,” Honda spokesperson Chris Naughton told RDN on Friday. “At this time, we have not identified evidence that customer information was accessed, and our investigation remains ongoing. Honda was able to safely restore iN services on Wednesday (10/28/26).”

A collision repair shop received an email on Oct. 29 from a Honda dealership saying that a cybersecurity attack compromised Honda iN, preventing more than 1,100 dealerships nationwide from checking inventory availability and placing new parts orders.

Separately, an anonymous tip provided to RDN indicated some collision centers have been compromised through email links, allowing threat actors to access CCC’s estimating and management systems.

They said once the link is clicked, threat actors access and change passwords in the systems, then use them to contact insurance companies posing as collision centers, saying the customer removed the vehicle, or that the insurance company should just pay the customer, and provide updated account information.

They’ve also reportedly called an insurance company, posing as the customer, and said they aren’t getting the vehicle repaired and want to cash out.

CCC didn’t confirm or deny the tip. However, CCC shared information about the security advisories it provides to shops to help protect themselves.

“This is an important topic,” said Michelle Hellyar, CCC spokesperson. “Email phishing, social engineering, and impersonation scams are an increasing threat across industries. Like many technology providers, CCC periodically shares security advisories and best practices to help customers recognize and avoid these attacks. These advisories are preventive in nature and not prompted by a compromise of CCC’s systems.

“In our advisories, we encourage businesses to use multi-factor authentication, never share passwords, exercise caution with unexpected requests involving sensitive information or payment changes, and independently verify those requests through established, trusted contacts before taking action.”

Last year, IT services company StoredTech simulated the ramifications of a fictional cybersecurity attack on an auto repair shop for attendees of a Collision Industry Conference (CIC) meeting.

In the scenario, the owner replied to an email that he thought was from his trusted supplier, “Tool Titans.” The email asked for information to complete a tool order and included multi-factor authentication.

Allan Polak, StoredTech senior of technology, said the hackers threatened to permanently delete all of Bob’s data and leak it to the dark web if half a Bitcoin wasn’t paid within 72 hours.

Polak guided the audience through Bob’s decision to pay the ransom after three days of no business operations.

“Threat actors used the stolen passwords to gain access to multiple computers in Bob’s office, and they gained access to other resources, like phones, cloud, files, et cetera,” Polak said. “And once they gained access to those computers, they also found an Excel spreadsheet. That Excel spreadsheet was a treasure trove. It had all kinds of passwords for them, including some personal accounts, and they use that to just gain a larger foothold and go deeper and deeper.”

Images

Featured image credit: KanawatTH/iStock