Lefkoff Law principal and founding attorney Steven Lefkoff immediately arrived at this assertion when he learned that Cox Automotive on Monday acknowledged “suspicious activity” that was “quickly contained” within VinSolutions.

“The trickle down to the dealers could be enormous because ultimately the dealers, under federal law, under the Safeguards Rule, are still responsible if their vendors get hacked,” Lefkoff told Auto Remarketing on Tuesday.

Lefkoff explained that a dealer who arranges financing is covered by the Federal Trade Commission’s Safeguards Rule, which requires that stores oversee the vendors that hold its customers’ personal information.

Furthermore, Lefkoff pointed out that if unencrypted customer information of 500 or more consumers was acquired without authorization, the dealer may have its own duty to notify the FTC within 30 days of discovery.

Lefkoff, who is a part of the continuing education faculty for the National Independent Automobile Dealers Association and the Georgia Independent Automobile Dealers Association, explained how easily a dealership could hit that 500-individual threshold.

“The way the federal law defines it is not just customers as we think of them as somebody who actually bought a car,” Lefkoff said. “The way it’s actually defined is when you get into non-public personal information. Well, that could be a credit app. You could have a dealer that it doesn’t take very long to get a collection of over 500 credit applications. You might have 10 people that fill out credit apps today, and they’re all tire kickers. Not a single one of them actually buys a car, but they count towards that limit.”

Cox Automotive told Auto Remarketing on Monday, “Based on our investigation so far, we believe this affected a limited subset of our VinSolutions dealers and will notify any affected parties directly and in line with our obligations.”

Whether or not the dealership is among the VinSolutions clients, Lefkoff used the development to reiterate several recommendations to dealer principals and managers.

“It’s extremely important that dealers are aware of the contracts they’re signing, are familiar with the vendors they’re using, audit the software for holes and for any issues that could arise in security, and then as best they can, protect themselves using their own contracts so that if something happens, they’re not at the mercy of the bigger players in the industry,” Lefkoff said.

“It’s a reminder to audit your vendors and use this as an example. Think of all the different vendors you use at your dealership for all kinds of things, everything from email to internet, your Wi-Fi, your physical devices, who has access to your networks,” he continued.

“It’s important to take this as a lesson and have a healthy concern about the risks involved, especially when you’re dealing with people’s private information that they give you, assuming it’s going to be safe and that their identity is not at risk just because they tried to go get a car,” Lefkoff said.

And, unfortunately for the car business, this attack on Cox Automotive and VinSolutions isn’t an isolated incident. Impacted dealers likely remember the widespread turmoil created when CDK Global sustained a ransomware attack two years ago.

“In practicing law and specifically with a focus on representing car dealers for almost 20 years, I have seen more fraud in the last four to five years than I have seen in the first 15 combined. And the reason I say that is twofold,” Lefkoff said.

“No. 1, we are seeing more transport fraud than we’ve ever seen, at least in my office, as far as dealers buying cars at auction then being loaded on trucks and then never being delivered to their destination. And we are also seeing more consumer fraud because the consumers are using, and we’ve verified this, they’re using AI to create ways to get out of their contracts and get out of their obligations. And it’s cost a lot in legal fees for my clients to deal with. It’s cost a lot in terms of financial losses, and it’s become rampant,” he continued.

“If you think about the car industry, most people don’t know this, but there are so many moving parts in order for a car to be sold to a consumer,” Lefkoff added. “The car isn’t just there. There’s the auction, there’s delivery, there’s insurance, there’s mechanics, there’s title work, there’s financing, there’s all kinds of things that go into getting a car into a consumer’s hand.

“And with more ability for bad actors to find ways to commit fraud, there’s more fraud being committed. It’s at every step, every level, and each of those, there is a hole somewhere. Some of it’s not preventable, but you do the best you can to protect yourself when or if it happens to you,” he said.