Loading story…
Investigators have linked the main breach in Jaguar Land Rover's major cyberattack to Russian hackers, according to reporting citing people close to the case. The attack halted production for months and triggered a broad investigation involving Microsoft, the FBI, the U.K. National Crime Agency, the National Cyber Security Centre, Google Mandiant, and Palo Alto Networks. Microsoft reportedly tracked the Russian group and warned JLR, while investigators said it remains unclear whether the operators were state-directed, criminal, or criminals tolerated by the Russian government. The inquiry also found that a separate Jordanian hacker using the alias Rey had compromised parts of JLR's network, making the incident a multi-actor intrusion.
The Cyber Monitoring Centre estimated the disruption caused £1.9 billion in damage to the U.K. economy, or about $2.5 billion, with effects spreading to more than 5,000 businesses. The fallout reportedly drove U.K. car production down to levels not seen since 1952, and the Bank of England cited the damage in its economic outlook, underscoring how the attack's impact extended far beyond Jaguar Land Rover's own operations.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Investigators found that a separate Jordanian hacker using the alias Rey had also breached some Jaguar Land Rover networks. This established the incident as a multi-actor compromise rather than a single-actor intrusion.
Investigators concluded that Russian hackers were behind the main Jaguar Land Rover breach, though it remained unclear whether they were state operators, criminals, or criminals tolerated by the Russian government. This attribution was reported by The New York Times based on people close to the investigation.
Microsoft reportedly tracked the Russian threat group tied to the main Jaguar Land Rover breach and alerted the company. The subsequent investigation also involved the FBI, the U.K. National Crime Agency, the National Cyber Security Centre, Google Mandiant, and Palo Alto Networks.
Jaguar Land Rover suffered a major cyberattack last year that halted production for months. The Cyber Monitoring Centre later estimated the incident caused £1.9 billion ($2.5 billion) in damage to the UK economy and affected more than 5,000 businesses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcemalware.news
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jaguar Land Rover (JLR) suffered a major cyberattack that resulted in the shutdown of its manufacturing operations for over a month, causing significant disruption across its supply chain and dealership network. The incident, which began in late August 2025, affected JLR’s IT systems and halted production at key plants in Solihull, Halewood, and Wolverhampton. More than 5,000 organizations in the UK were impacted, including suppliers and downstream businesses, as orders were canceled or delayed and dealer systems went offline. The Cyber Monitoring Centre (CMC), a nonprofit specializing in cyber incident analysis, estimated the economic impact at £1.9 billion ($2.5 billion), making it the most economically damaging cyber event in UK history. The CMC classified the event as a "Category 3 systemic event," indicating a severe but not the highest level of national impact. The financial estimate was based on a modeled range of £1.6 billion to £2.1 billion and only considered the UK, suggesting the global impact could be even greater. The disruption to JLR’s operations threatened the viability of businesses in its supply chain, putting thousands of jobs at risk and prompting calls for government intervention. In response, the UK government provided emergency financial support amounting to £1.5 billion to help JLR recover and stabilize its operations, although the CMC noted that the full cost to taxpayers might not materialize if the support is not fully utilized. JLR also launched a financing scheme to provide up-front cash to suppliers facing financial hardship due to the shutdown. The incident highlighted the systemic risk posed by cyberattacks to critical manufacturing sectors and the broader economy, with experts warning that cyber resilience is now a matter of national security. The event underscored the interconnectedness of modern supply chains and the cascading effects a single cyber incident can have across multiple industries. The CMC’s analysis emphasized the need for organizations to strengthen their cyber defenses to prevent similar large-scale disruptions in the future. The government’s intervention in this case could set a precedent for future responses to major cyber incidents affecting national infrastructure. The attack’s impact on JLR, which accounts for roughly 4% of all British goods exports, demonstrates the potential for cyber threats to undermine key economic sectors. The event has sparked debate about the adequacy of current cyber insurance and risk management practices in the face of systemic cyber threats. Industry leaders and policymakers are now reassessing strategies to bolster cyber resilience and protect critical supply chains from future attacks. The JLR cyberattack serves as a stark warning of the far-reaching consequences of cyber incidents on both organizational and national levels.
Jun 29, 2026
Jaguar Land Rover suffered a significant cyberattack in September that forced the automaker to halt production for several weeks, resulting in a 43% year-on-year decline in wholesale volumes for the third quarter. The disruption affected global supply chains, with manufacturing only returning to normal levels by mid-November, and led to substantial delays in distributing vehicles to dealers worldwide. The attack's impact was felt across all major markets, with North America experiencing a 64% drop in wholesale volumes, Europe 48%, China 46%, and the UK market seeing a smaller decline of 0.9%. The company also faced additional challenges from US tariffs and the planned discontinuation of legacy Jaguar models. Financially, the cyberattack cost Jaguar Land Rover £196 million ($220 million) in the quarter, and the Bank of England cited the incident as a contributing factor to the UK's weaker-than-expected GDP growth. The attack was later claimed by the Scattered Lapsus$ Hunters, a group linked to Lapsus$, Scattered Spider, and ShinyHunters. In addition to production and sales losses, JLR confirmed that data was stolen during the breach, including payroll information. The full financial impact is expected to be detailed in the company's upcoming quarterly results.
Jun 29, 2026
Jaguar Land Rover (JLR) suffered a significant cyberattack in late August 2025 that forced the shutdown of several major manufacturing plants across the UK, including Solihull and Halewood. The attack began as what appeared to be a minor IT issue but quickly escalated, with hackers damaging critical servers responsible for production schedules and supplier payments. As a result, production lines halted, screens froze, and workers were left idle on the factory floor, leading to a complete stop in vehicle manufacturing for several weeks. The impact of the cyberattack extended far beyond JLR itself, severely disrupting its extensive supply chain and prompting rare financial intervention from the UK government. The Bank of England cited the JLR incident as a key factor in the country's slower-than-expected GDP growth for Q3 2025, marking the first time a cyberattack has caused material economic harm at a national level. The Cyber Monitoring Centre classified the event as a Category 3 systemic incident, with estimated losses to the local economy reaching up to £2.1 billion, and direct harm to JLR alone exceeding £2 billion in lost revenues.
Jun 29, 2026