It sounds from the article like a rogue dealership. In any case Ford should audit access logs for these keys and look for odd access such as a high volume in area beyond statistical clustering.