A devastating cybersecurity attack led to a significant data breach and severe operational disruption for Jaguar Land Rover (JLR), underscoring key cybersecurity gaps in electric vehicle manufacturing.
Although the company has remained silent about the extent of the data breach, it admitted that hackers were able to gain access to some of its sensitive information and systems. JLR announced the cyber incident on September 2, 2025.
Fallout from the massive attack is still being felt both here and abroad.
In this article, we’ll discuss the latest news on the Jaguar Land Rover cyber incident and the perpetrators believed to be behind the attack. We’ll also discuss five top ways businesses can protect themselves and their IT assets from lurking cyber threats.
In the Jaguar Land Rover attack, malicious actors were able to gain unauthorized access to take control of its systems and steal valuable data. The information was then used as an extortion chip in a subsequent ransomware attack.
A cybercrime gang known as Scattered Spider has claimed responsibility for the Jaguar Land Rover attack, which shut down its production lines on August 31, 2025.
Related Article: How Scattered Spider Social Engineering Attackers Target Helpdesks
The aftershock is still reverberating at JLR dealerships both here and abroad.
The attack has caused widespread disruption to the UK-based company’s global manufacturing network, according to Cyber Magazine.
JLR, Britain’s largest auto manufacturer, has had to shut down its UK, India, China, and Slovakia production plants. The company has said it is considering a controlled restart of its operations on September 24.
The ongoing work stoppage has led to a domino effect of problems, including a crippling cash crunch among some of its many smaller suppliers, parts shortages, and a backlog of customers who have been unable to register new vehicles.
All of this spells bad news for the automotive manufacturer during what is normally a peak selling period for the industry. So far, early estimates have put the company’s projected financial losses stemming from the cyberattack at more than $1.36 billion (US).
The Scattered Spider hacking group, believed to be largely made up of teenagers and young adults, has claimed responsibility for an expanding web of high-profile ransomware attacks in recent years.
The attackers have hit diverse industries, including casinos, retailers, airlines and transportation, healthcare, financial services, technology, insurance, food services, and education.
According to published reports, Caesars Entertainment paid a ransom of $15 million in 2023 after having its systems hacked by the group, representing half of the group’s initial ransom demand.
In a separate Scattered Spider attack, Clorox reported spending approximately $49 million in recovery costs after its operations came to a standstill, causing extensive manufacturing and shipping delays. The company said in total, the attack cost it more than $356 million in net sales losses.
According to published reports, the JLR ransomware attack began as a data breach, although the exact tactic used by the attackers remains under investigation. The company, which is owned by India’s Tata Motors, has yet to disclose the extent of the breach or say what type of data was exfiltrated in the breach.
The company has said it was in the process of reporting the cyber incident to the required regulatory agencies. With its operations and supply chain still dealing with the fallout and amid mounting financial losses, the JLR cyberattack is an example of the widespread, catastrophic ripple effect of growing cyber threats.
So, auto manufacturers, their dealerships, and other businesses within their extensive supply chain have to implement robust security precautions to help mitigate the chances of a cyber incident.
When a large automaker like JLR is forced to shut down is systems and temporarily shutter operations, the impact to its auto dealerships and the many small and medium-sized suppliers that depend on the company could leave them facing an existential crisis.
In today’s rapidly evolving threat landscape, cybercriminals are using increasingly sophisticated tactics to launch phishing attacks that are so convincing that even trained experts have been fooled.
A major factor helping them find their newest targets and generate such believable fraudulent emails, phone messages, videos, and other schemes is artificial intelligence. The cyber scams also help them to circumvent traditional cybersecurity controls to gain unauthorized access into your systems.
Oftentimes, the hackers are willing to spend time developing a relationship with their targets to establish trust, making it easier to get them to send money to an account controlled by the attackers or to share sensitive information such as account login credentials.
The massive CDK Global ransomware attack in 2024 left thousands of dealerships throughout the U.S. and Canada scrambling to keep the doors open after attackers were able to exploit a cybersecurity flaw within a vendor’s systems.
Related Article: Why Cybersecurity Will Remain Critical For Car Dealerships in 2025
Although the specific security gap has not been disclosed, it is believed that cybercriminals were initially able to gain unauthorized access through a phishing email after an employee inadvertently clicked on a malicious link. This provided an opening to deploy the larger ransomware attack.
For auto dealerships and other supply chain businesses, proactive IT support can provide you not only with cybersecurity resilience, but also peace of mind.
A reliable managed IT service provider (MSP) can offer a number of customized solutions tailored to your business to boost your overall cybersecurity posture and reduce threat risks.
Those proactive steps include:
Related Article: What Are Effective Data Backup Solutions For Business Continuity?
After reading this article, you know have a better understanding of why enterprises of all sizes need to make sure they have stringent security measures in place to protect against growing cyber threats.
We write articles like this to provide information to help businesses like yours make the best IT-related decisions for your organization.
At Kelser, we have decades of experience providing customized cybersecurity solutions to keep our customers running efficiently, smoothly, and securely.
If you don’t have an internal IT team with the time or specialized skills to implement the security controls mentioned above, or have questions about what solutions might be best for your organization, reach out to us now by clicking the button below.
One of our IT experts will respond to schedule a brief chat to learn more about your cybersecurity concerns and see how we can help.