Blog

Jaguar Land Rover Pauses Production After Extensive Cyberattack

On September 2, 2025, Jaguar Land Rover announced the organization had been impacted by a cyber incident which would require a controlled restart of global operations.

Pierre Lamy
September 19, 2025
Table of contents

Incident Summary

  • In early September 2025, Jaguar Land Rover (JLR), a British luxury vehicle manufacturer, was hit by a devastating cyberattack that severely disrupted its production and retail operations.
  • The attack, claimed by the Scattered Spider cybercrime group, led to the theft of some data from JLR's systems. The company initially reported no evidence of customer data theft but later confirmed a data breach.
  • The cyberattack forced JLR to extend its production halt into a third week, costing the company at least £50 million weekly in lost output. The disruption has also significantly impacted JLR's supply chain, with suppliers like Autins facing financial strain.
  • JLR is working on a controlled restart of its global operations while continuing its forensic investigation. The incident has raised concerns about the vulnerability of the industrial sector to cyberattacks and calls for government intervention to support affected businesses and workers.

The Issue

The cyberattack on Jaguar Land Rover was a sophisticated and targeted incident that severely disrupted the company's operations. The attackers, identified as the Scattered Spider group, were able to infiltrate JLR's systems and steal sensitive data. This data breach has raised concerns about the potential exposure of customer information and the broader implications for the company's reputation and liability.

The attack also had a significant impact on JLR's production and supply chain. The company was forced to halt operations at its British plants for over three weeks, costing an estimated £50 million per week in lost output. This disruption has had a ripple effect on JLR's extensive supply chain, with smaller suppliers like Autins facing financial strain and the potential for layoffs.

Response and Restoration

In response to the attack, JLR acted quickly to isolate its systems and prevent further damage. The company shut down IT operations across its distributed facilities to limit the attackers' ability to move laterally through the network. This decisive action likely helped to contain the incident and minimize the overall impact.

JLR is now working to carefully and methodically restart its global operations in a controlled manner. The company is conducting a thorough forensic investigation to understand the full extent of the breach and the data that may have been compromised. JLR has also informed relevant regulators about the incident and is committed to contacting any individuals whose data may have been affected.

Lessons Learned

The JLR cyberattack highlights the need for organizations, particularly in the industrial and manufacturing sectors, to prioritize robust cybersecurity measures and incident response planning. Some key recommendations include:

1. Diversifying technology stacks: Reliance on a single technology or vendor can create a monoculture that increases risk. Organizations should strive for a diverse technology ecosystem to mitigate the impact of a successful attack on any one system.

2. Securing Active Directory: Attackers often target Active Directory as a means to move laterally through a network. Implementing strong authentication, eliminating legacy protocols, and implementing comprehensive monitoring are essential.

3. Adopting a zero-trust model: The traditional perimeter-based security approach is no longer sufficient. Organizations should transition to a zero-trust model that verifies and continuously monitors all access, regardless of the user or device.

4. Enhancing supply chain resilience: The JLR incident underscores the need for organizations to understand their supply chain dependencies and implement measures to ensure business continuity in the event of a disruption.

5. Increasing government support: The broader economic impact of the JLR cyberattack highlights the need for government intervention and support for affected businesses and workers. Policymakers should consider emergency measures and funding to mitigate the ripple effects of such incidents.

Sources:

Actor Summary:

Scattered Spider is a prolific eCrime adversary that has conducted a range of financially-motivated activity since early 2022. The group initially targeted firms specializing in customer relationship management (CRM) and business-process outsourcing (BPO), as well as telecommunications and technology companies. Over time, Scattered Spider expanded its operations to compromise victims in the gaming, hospitality, retail, MSP, manufacturing, and financial sectors, leveraging sophisticated social-engineering techniques like phishing, SIM swapping, and exploiting weak verification processes to gain unauthorized access. The group is known for deploying ransomware, often acting as an affiliate for ransomware groups like ALPHV/BlackCat, to extort victims and threaten to leak stolen data. Scattered Spider is a financially-motivated, native English-speaking cybercriminal group that has been active since at least 2022 and is believed to have members based in the United States and United Kingdom.

‍

Pierre Lamy

With more than 20 years of experience, Pierre has built and led cyber threat intelligence, incident response, and security operations programs across financial services, global enterprises, and industry trust groups. Previously, he served as Global Head of Threat Intelligence at S&P Global, where he built and scaled an enterprise intelligence program and incident response capability. His earlier roles include leadership positions at Flashpoint and FS-ISAC, as well as securing global enterprises through his work at Check Point and Nokia. He has also contributed to industry standards, co-authoring ISAO’s framework on cybersecurity analysis.

Widely regarded as a trusted voice in the threat intelligence community, Pierre is known for fostering collaboration, building intelligence-sharing networks, and shaping best practices adopted across industries and governments. His longstanding influence, technical expertise, and reputation for integrity have made him a respected leader among peers, partners, and adversary-focused defenders worldwide.

Read more by ANTHONY

Discover More About Anomali

Get the latest news about cybersecurity, threat intelligence, and Anomali's Security and IT Operations platform.

SEe all Resources
No items found.

Propel your mission with amplified visibility, analytics, and AI.

Learn how Anomali can help you cost-effectively improve your security posture.

schedule a demo
September 19, 2025
-
Pierre Lamy
,

Jaguar Land Rover Pauses Production After Extensive Cyberattack

Explore more topics

Anomali
Anomali Copilot
Anomali Cyber Watch
Anomali Security Analytics
Anomali Security Operations Platform
Compliance
Cyber Threat Intelligence
ISAC
IT Operations
Malware
Modern Honey Network
Research
SIEM
SOAR
STAXX
Security Operations
Splunk
Threat Intelligence Platform
ThreatStream
UEBA
No items found.