The attack on Jaguar Land Rover: a breakdown of CYFIRMA's investigation
On 2 September 2025, Jaguar Land Rover shut down its global IT systems. Production and retail operations stopped, including at the Halewood plant, and staff were sent home. We break down what's known about the attack chain and why every manufacturing company should study this incident.
---
## The timing was as bad as it could get
The attack coincided with the UK's "new registration plate day" — the day dealers
register and hand over the highest volume of cars of the half-year. Registering and
delivering vehicles to customers became impossible, multiplying the financial losses.
On 16 September the company said the investigation was continuing and extended the
production halt until 24 September, notifying its supplier partners.
## Backstory: JLR was already breached in March
The September incident wasn't the first. Six months earlier the company suffered two
leaks through the same channel.
On **10 March 2025**, the HELLCAT group claimed to have leaked around 700 internal JLR
documents. Access was obtained via **stolen Jira credentials** harvested by an
infostealer. The leak included development logs, task-tracking data, source code, and a
batch of employee data: usernames, email addresses, display names, and time zones.
On **14 March 2025**, a second attacker using the handle APTS posted roughly another
**350 GB**. He used infostealer credentials **dated back to 2021**, belonging to an
employee with third-party access to the Jira server.
Sit with that detail for a moment. An account compromised four years before the
incident was still active.
HELLCAT's typical playbook looks like this: phishing or exploitation of
publicly-facing applications for initial access, then persistence via PowerShell, AMSI
bypass and reflective code loading, with the final payload being SliverC2 for
persistent remote access.
## Who claimed responsibility
The Telegram channel **Scattered Lapsus$ Hunters** published screenshots of JLR's
internal IT systems. The name combines three English-speaking communities: Scattered
Spider, Lapsus$, and ShinyHunters. The company has not officially confirmed the nature
of the attack.
## What was in the leak, and why it matters
**Internal domain infrastructure.** One of the screenshots shows the domain
`jlrint.com` — presumably the company's internal domain. Alongside it, internal DNS
dependencies and host resolutions were exposed, as well as hardcoded production
systems for the **Solihull and Gaydon** sites. For an attacker, this is a map for
lateral movement: manipulating hosts files, DNS responses, misconfigured or hardcoded
records, and third-party service integrations all become footholds.
**The vehicle's internal logic.** Task SIMS-23441 was published, concerning the
infotainment system — EV charging mode transitions in the PIVI platform, with exact
signal names and expected behavior tied to interface states. Separately, there was a
debug log from the Pivi Pro platform, apparently pulled from a test bench during
quality control.
**Authentication logic.** The most sensitive fragment is the backend code that binds
user profiles to vehicles: processing incoming JSON messages, extracting
authentication results, logging. This is the connected-car module critical for
identification and access. Publishing this code opens the door to reverse engineering
and hunting for weaknesses in token handling and authenticity checks.
## Why the attackers published all of this
Analysts identify five motives, and money isn't at the top of the list:
1. **Proof of access.** Internal domains, debug logs, and backend code prove access
to locked-down systems, not just surface-level data.
2. **Psychological pressure** on the company and reputational damage.
3. **Recognition among peers.** Technical detail builds reputation within the
cybercriminal community.
4. **A strategic signal.** Demonstrating access to charging logic, authentication,
and infotainment modules hints at the possibility of more destructive actions.
5. **A threat of escalation.** In parallel, threats were made against UK telecom
companies: taking down internet lines, stealing call logs, and publishing
politicians' correspondence.
The assessed motivation is **reputational and strategic rather than purely
financial**: there's no direct evidence of ransom demands.
## An important warning about verifying sources
A separate finding from the investigation, useful to anyone writing about incidents:
Telegram has been flooded with **fake accounts** impersonating Scattered Spider,
Lapsus$, and ShinyHunters. They repost old files from past leaks, passing them off as
new activity.
The original ShinyHunters channel is blocked, and ShinyCorp's official statement makes
clear the group has no presence on Telegram.
## Key techniques by MITRE ATT&CK
| Tactic | ID | Technique |
|---|---|---|
| Initial Access | T1078 | Valid Accounts (stolen Jira credentials) |
| Initial Access | T1566 | Phishing |
| Execution | T1059.001 | PowerShell |
| Credential Access | T1555.003 | Credentials from Web Browsers |
| Discovery | T1046 | Network Service Discovery (internal DNS records) |
| Collection | T1005 | Data from Local System (logs, source code) |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Impact | T1489 | Service Stop |
## The takeaway
Attribution is given with **medium confidence** and remains unconfirmed; there were no
official investigation results at the time the report was published. Direct
compromise of customer data has not been confirmed.
Practical lessons that apply to any manufacturer:
- **Credential rotation and revocation.** A 2021 infostealer credential still
working in 2025 isn't a sophisticated attack — it's the absence of a process.
- **Contractor access.** The entry point was an employee with third-party access to
Jira. Every external access grant needs an owner, an expiry date, and a review.
- **MFA and monitoring for compromised credentials.** Watching for credential leaks
tied to your own domains is a cheap control with a direct payoff.
- **Detecting lateral movement** across endpoints and the network. That's exactly
the phase that went unnoticed in this incident.
- **Joint IT/OT exercises.** Specifically rehearse the scenario where IT
preemptively shuts down and production follows.
---
*This piece is based on CYFIRMA's "Investigation Report on Jaguar Land Rover
Cyberattack." Original:
https://www.cyfirma.com/research/investigation-report-on-jaguar-land-rover-cyberattack/*