Russian Hackers Linked to Massive Jaguar Land Rover Cyberattack, Report Says

Last year, automotive giant Jaguar Land Rover (JLR), one of the United Kingdom’s largest employers, suffered a major cyberattack that disrupted vehicle production for months and delivered a significant blow to the country’s economy. The impact was so severe that the U.K. government stepped in with a £1.5 billion (approximately $2 billion) support package. At the same time, estimates suggest the overall economic damage from the attack reached around $2.5 billion.

For several months, the identity of those responsible remained the subject of speculation. Now, citing sources familiar with the investigation, The New York Times reports that the attackers were Russian. However, it remains unclear whether the hackers were operating directly on behalf of Vladimir Putin’s government, acting independently as cybercriminals, or functioning somewhere in between as criminal groups working with the tacit approval of the Russian state.

According to the report, Microsoft had been tracking the Russian hacking group and had alerted Jaguar Land Rover to information about the attackers’ identities. Sources also told The New York Times that several other organisations contributed to the investigation, including the U.S. Federal Bureau of Investigation (FBI), the United Kingdom’s National Crime Agency (NCA), the National Cyber Security Centre (NCSC), Google’s Mandiant cybersecurity division, and Palo Alto Networks.

In what investigators described as an unusual, though not unprecedented, development in the cybersecurity world, the Russian group was not the only party to compromise parts of Jaguar Land Rover’s networks. According to The New York Times, a Jordanian hacker using the online alias “Rey” had also gained unauthorised access to certain JLR systems during the incident.