Russian hackers linked to $2.5B Jaguar Land Rover cyberattack

Russian cybercriminals carried out the August 2025 hack on Jaguar Land Rover that halted production for weeks and cost the UK economy an estimated $2.5 billion, The New York Times reports.nytimes+1
Microsoft alerted JLR to the attackers' identity shortly after the breach; the FBI, the National Crime Agency, and Google's Mandiant unit all contributed to the investigation.nytimes+1
Investigators have not determined whether the hackers acted on Kremlin orders or independently, and the UK government has yet to make the attribution official.yahoo+1

Russian hackers carried out last year's cyberattack on Jaguar Land Rover that shut down production for nearly six weeks and inflicted an estimated $2.5 billion in damage on the British economy, according to a New York Times investigation published on Thursday. The finding, based on months of work by an unusually broad coalition of government and private-sector investigators, marks the first confirmed attribution of what is considered the most financially devastating cyberattack in UK history.techcrunch+2

A Broad Investigation

Microsoft was tracking the Russian hacking group and alerted JLR to the attackers' identities in the days following the breach, according to the Times. The FBI, Britain's National Crime Agency, the National Cyber Security Centre, Google's Alphabet Inc. Mandiant unit, and Palo Alto Networks all contributed to the investigation. Investigators have not determined whether the hackers were acting on direct orders from the Kremlin, operating independently, or working with the Russian government's tacit approval.nytimes+1

The attribution contradicts earlier claims by a group calling itself Scattered Lapsus$ Hunters, which took credit on Telegram shortly after the breach. That collective appeared to be tied to English-speaking cybercrime networks, but the investigative trail has since shifted to a separate Russian operation.thenextweb+2

How the Attack Unfolded

The breach began on August 31, 2025, when attackers used a vishing campaign — phone calls impersonating internal staff — to trick JLR employees into handing over login credentials. With valid usernames and passwords, in some cases carrying administrator privileges, the hackers moved laterally across JLR's IT networks. Production lines across the UK, and eventually at plants in multiple countries, ceased on September 1.industrialcyber+3

The UK's Cyber Monitoring Centre estimated total economic damage at £1.9 billion, with more than 5,000 organizations across JLR's supply chain affected. The Bank of England later attributed a shortfall in GDP growth partly to the attack. The UK government responded with an emergency loan of £1.5 billion to stabilize JLR's supply chain, an unprecedented intervention for a cyber incident.thenextweb+2

A Tangled Crime Scene

In a rare twist, investigators discovered that the Russian group was not the only intruder inside JLR's networks. A Jordanian hacker operating independently had also breached parts of the company's infrastructure, according to the Times. The overlap of two unrelated intrusions underscores a growing problem in cybersecurity, as state-linked and criminal hackers increasingly converge on the same high-value targets. The parent company, Tata Motors, has not publicly commented on the attribution findings.thenextweb

Sources (25)