Where Your Customer Data Actually Lives (and Who Has to Tell Them When It Leaks)

On October 26, Cox Automotive confirmed it found and contained suspicious activity in VinSolutions, the CRM about 7,000 dealerships run on. A group calling itself Scarlett Group had listed VinSolutions on its leak site 3 days earlier and claimed it holds Social Security numbers, driver's license numbers and credit applications. Cox has not confirmed what data was involved, and says it will notify the affected dealers directly. Sources: ComplyAuto and Repairer Driven News.

The part most owners miss: if customer data was taken, the notice duty is usually the dealer's, not the vendor's. Under the FTC Safeguards Rule a dealer is a financial institution. If unencrypted information on 500 or more customers is taken, the dealer reports to the FTC within 30 days of finding out. State notice laws add their own deadlines, based on where each customer lives.

That applies to any business holding customer data in someone else's software, not only car stores.

Map it in an afternoon

Most businesses have never listed every system that touches a customer in one place. One sheet does it:

1. Every system that stores a customer's name, phone, email, ID or credit data. CRM, DMS, credit app portal, texting tool, website forms, the AI chat on your site, shared drives.
2. Who owns the vendor relationship, and who gets the call when something goes wrong.
3. What the contract says about breach notice: how fast the vendor tells you, and in what form.
4. Who has a login, including people who left. Old logins are how most of these start.
5. Where copies live. Exports to spreadsheets and email attachments count.

Before you connect any AI tool

Add the AI tool to the same sheet before it touches the CRM. Ask the vendor 3 questions: where the data is stored, whether it is used to train anything, and how fast they tell you about an incident. If they can't answer in writing, the tool waits.

Control Point AI Firm helps businesses build this map and the workflow around it. Start with a free AI audit.

This is general information, not legal advice. Confirm your notice obligations with counsel.