Jaguar Land Rover Cyber Attack

On May 5, 2025, Scattered Spider launched a targeted attack against JLR. The group used social engineering to gain initial access, then deployed ransomware across critical systems. The attack forced the company to shut down several production lines for nearly two weeks, affecting thousands of vehicles. Customer and employee personal data was also exfiltrated.

Jaguar Land Rover is one of the UK's largest automotive manufacturers and a major exporter. Like many manufacturers, its complex supply chain and reliance on IT systems make it highly vulnerable to ransomware.

Attackers used vishing to compromise IT support staff, gained domain admin access, and deployed ransomware. They also exfiltrated large volumes of data before encryption. The attack heavily impacted manufacturing execution systems (MES).

Vulnerabilities exploited

• Social Engineering
• Weak helpdesk verification processes

Scattered Spider – notorious for using social engineering and vishing to target large, high-value organizations.

Aliases

• Scattered LAPSUS$ Hunters
• SH

Attribution sources

• Jaguar Land Rover statements
• BleepingComputer
• The Times
• Cybersecurity firms

Countries affected

• United Kingdom
• Global

Data types

• Customer PII
• Employee Data
• Supplier Information
• Internal Business Data

Estimated losses exceeded £200 million due to production downtime, lost sales, and recovery costs.

Public reaction

Widespread concern over production delays and data privacy.

Political impact

UK government expressed serious concern over critical manufacturing sector security.

Ongoing ICO and regulatory investigations.

Civil lawsuits

• Multiple class-action and supplier claims

Policy changes

• Stronger cybersecurity requirements for UK automotive sector.

Security improvements

• Major overhaul of identity verification processes
• Improved network segmentation
• Enhanced backup and recovery capabilities

Significance

One of the most expensive and disruptive ransomware attacks on a UK manufacturer in 2025.

Legacy

Became a case study for ransomware impact on physical manufacturing and supply chains.

Publishing organisations

• BBC
• The Times
• Reuters
• BleepingComputer

Production gradually restored by late May 2025; data was leaked by the attackers.

Official documents

• JLR Cyber Incident Statement

References

1. [1]Jaguar Land Rover official updates
2. [2]BBC News
3. [3]The Times coverage