Investigation Report on Jaguar Land Rover Cyberattack

Executive Summary

CYFIRMA analyzed the September 2, 2025, Jaguar Land Rover (JLR) cyber incident, which caused widespread disruption by shutting down global IT systems and halting manufacturing and retail operations, including at Halewood, while employees were sent home. The attack coincided with the UK’s “New Plate Day,” intensifying financial losses as dealers could not register or deliver vehicles. Although some customer data breaches have been confirmed, the exposure of internal systems by Scattered Spider Lapsus$ Hunters group on the Telegram channel and prior HELLCAT attacks highlight IT and operational risks.

Assessment

On September 16th, Jaguar announced that the forensic investigation of the cyber incident is still ongoing. As a result, the company has extended the suspension of production until Wednesday, September 24, 2025, and communicated the same update to its supplier partners.

While JLR has not shared details on the scope or nature of the breach till now, the incident appears to align with a wider trend of advanced cyberattacks on the automotive sector. Notably, earlier this year, the HELLCAT ransomware group targeted JLR in separate attacks, exfiltrating hundreds of internal documents and compromising employee data through stolen Jira credentials.

BACKGROUND OF JAGUAR LAND ROVER BREACH

Earlier, Jaguar Land Rover was Breached by HELLCAT Ransomware Group Using the Infostealer Playbook

The HELLCAT ransomware group claimed responsibility for a major data breach against Jaguar Land Rover (JLR), in which gigabytes of sensitive information were leaked, including proprietary documents, source code, and employee and partner data. The attack, attributed to a threat actor known as “Rey” [identified by breach tracking platforms as an active member of HELLCAT] on a dark forum, on March 10, 2025, posted roughly 700 internal JLR documents that were compromised. The breach was enabled through stolen Jira credentials harvested via Infostealer malware, a known hallmark of HELLCAT’s operations. The exposed data includes development logs, tracking information, source code, and a large employee dataset with usernames, email addresses, display names, and time zones. The presence of verified employee information from JLR’s global workforce raises significant concerns about identity theft and targeted phishing campaigns.

HELLCAT’s attack on Jaguar Land Rover (JLR) followed its known tactic of exploiting stolen Jira credentials, a method seen in attacks on other organizations earlier. Emerging in mid-2024, HELLCAT has rapidly developed into a sophisticated ransomware group, using spear-phishing or public-facing application exploits for initial access, followed by PowerShell-based persistence, AMSI bypasses, and reflective code loading. The final payload typically delivers SliverC2, providing persistent remote access. The leaked JLR data, including source code, tracking information, and potentially cloud credentials, poses serious risks, from intellectual property exposure to potential targeting of individual customers.

Just days after Rey’s initial disclosure, the JLR breach escalated when a second threat actor, “APTS,” appeared on DarkForums on March 14, 2025. APTS claimed to have exploited Infostealer credentials dating back to 2021, belonging to an employee who held third-party access to JLR’s Jira server. Using these compromised credentials, the actor gained entry and shared a screenshot of a Jira dashboard as proof. APTS also leaked an additional tranche of sensitive data, estimated at around 350 GB, which contained information not included in Rey’s original dump, further amplifying the scale and severity of the breach.

HACKER GROUP

A Telegram channel calling itself Scattered Lapsus$ Hunters has claimed responsibility for Jaguar Land Rover’s cybersecurity incident, sharing a screenshot of Jaguar Land Rover’s internal IT systems. The channel’s name merges three English-speaking hacker collectives: Scattered Spider, Lapsus$, and ShinyHunters. Shinyhunters Collective has previously been linked to cyber-attacks on UK retailers. Jaguar Land Rover, however, has not yet confirmed the specifics or nature of the attack.

SHINYHUNTERS COLLECTIVE DISCLOSURE OF JLR INTERNAL DATA AND FUTURE THREATS

On September 3, 2025, while sharing news links related to the Jaguar Land Rover recent cyber incident, the Scattered Spider Lapsus$ Hunter Group also posted the following screenshot alongside.

• From the screenshot, we find a domain ‘jlrint.com’ which is most likely a Jaguar Land Rover Internal domain. The screenshot below could reveal internal DNS and host resolution dependencies that attackers could exploit if they gained access using stolen credentials. Manipulated host files or DNS responses, misconfigured or hardcoded entries, and third-party integrations could provide avenues for reconnaissance or persistence. The internal domain jlrint.com and hardcoded production systems at Solihull and Gaydon sites highlight potential weak points for lateral movement and operational impact within JLR’s network.

• The screenshot below reveals an internal JLR infotainment issue (SIMS-23441) related to EV charging mode transitions in the PIVI system. It exposes detailed signal names (ChargingModeChcToLatch, ChrgModReqTemp) and expected behavior tied to user interface states. The issue outlines backend-to-UI logic dependencies that are not functioning correctly. Its exposure indicates access to internal vehicle logic and testing processes, raising security and IP protection concerns.

• This appears to be an internal debug log from a Jaguar Land Rover infotainment system, likely part of the Pivi Pro platform and captured from development hardware or software during QA testing.

It was shared by the group Shinyhunters Collective, likely as proof they accessed internal JLR systems or proprietary data.
While the log itself may not be harmful, it is potentially part of a larger breach, making its exposure concerning.

• The screenshots below reveal that it could be a backend code for handling user-to-vehicle profile linking in a JLR system.It processes incoming JSON messages, extracts auth results, and logs outcomes. Likely part of a connected car or personalization module, critical to user identity and access.
  The exposed code reveals authentication logic, which may include potential vulnerabilities in how user profiles are linked to vehicles.
  This information could be used to reverse-engineer or exploit connected services, particularly if weaknesses exist in token handling or validation mechanisms.

• The attackers accused the NCA of targeting ShinyHunters collective and escalated their threats by claiming plans to disrupt telecommunications organizations in the UK, including cutting internet lines, stealing call logs, and leaking private conversations of politicians and officials. The group, previously responsible for high-profile breaches of UK retailers, appears to be deliberately focusing on UK-based organizations, suggesting a pattern of targeting critical businesses and infrastructure within the region.

• We have also identified multiple fake accounts posing as Scattered Spider, Lapsus$, and ShinyHunters groups. These impersonators are using Telegram channels to amplify old content and circulate the same messages. The original ShinyHunters collective Telegram account has been shut down, and the official ShinyCorp message explicitly states that ShinyHunters do not have a Telegram presence.

• The fake groups have been reposting outdated chatter and files from past breaches, attempting to pass them off as new activity. The last legitimate update from ShinyHunters appeared on BreachForums (.hn domain), where they clarified that their Telegram account was banned and that they will not be returning to the platform.

OBJECTIVE

Why could ShinyHunters Collective have posted all those screenshots?

• Proof-of-Access: By leaking internal domains, debug logs, and backend code, they demonstrate they have real access inside JLR’s private systems, not just surface-level data.
• Psychological Pressure: Public leaks are meant to intimidate JLR, damage its reputation, and pressure it (or UK authorities) into concessions.
• Validation for Peers: Sharing technical details signals credibility within the cybercriminal community, reinforcing their standing and attracting attention.
• Strategic Signaling: Highlighting infotainment, EV charging logic, and user-authentication modules shows they may have deeper access into critical systems, hinting at potential for more damaging attacks.
• Escalation Threat: Linking the JLR breach with threats against Vodafone UK and politicians signals broader hacktivist motives, mixing financial gains, disruption, and political messaging.

POSSIBLE MITRE ATT&CK TTPS.

Based on the screenshots, leaked backend code, debug logs, and internal host/DNS entries shared by ShinyHunters Collectives, we can map possible MITRE ATT&CK TTPs.

HYPOTHETICAL MOTIVE OF SHINYHUNTERS COLLECTIVE SPIDER ON JAGUAR CYBER INCIDENT

Based on the shared information, Shinyhunters Collective’s motives appear to be a mix of reputational and strategic rather than purely financial. By posting internal screenshots, backend code, and debug logs from Jaguar Land Rover systems, they are signaling technical prowess and gaining notoriety within the cybercriminal community. The targeting of operational systems, critical infrastructure, and connected vehicle modules suggests an interest in demonstrating control and influence, possibly to intimidate the company and its partners. While there is no direct evidence of ransom demands, the group could leverage the data for future exploitation or sell it, indicating potential financial incentives. Their references to geopolitical narratives in other posts hint at occasional ideological signaling, but the primary motive seems to revolve around recognition, influence, and potential leverage over the organization.

SCOPE OF IMPACT

Based on the evidence and posts shared by the ShinyHunters Collective, the actor’s perceived impact of the Jaguar Land Rover incident appears to be significant and multi-dimensional:

1. Operational Disruption: They likely view halting production and retail operations, including at Halewood, as a major success, demonstrating the ability to impact JLR’s core business.
2. Exposure of Intellectual Property: By leaking internal debug logs, backend code, and connected service modules, they perceive themselves as having gained access to proprietary technology and sensitive vehicle system logic.
3. Visibility and Credibility: Sharing screenshots and internal domain information (like jlrint.com) publicly reinforces their reputation as a capable hacker group, boosting credibility within cybercriminal communities.
4. Potential for Further Exploitation: Highlighting access to authentication processes and backend systems indicates they perceive the opportunity to leverage this access for lateral movement, further attacks, or resale of stolen data.
5. Psychological and Strategic Pressure: By posting on Telegram and referencing other targets (like Vodafone UK), they signal the ability to expand attacks, aiming to create fear and uncertainty among JLR, its partners, and the public.
6. Industry-wide Implications: The actor likely perceives their actions as part of a larger pattern of disrupting the automotive sector, potentially influencing competitors, suppliers, and customers to view cybersecurity as a systemic vulnerability.

CONCLUSION

The analysis suggests that the Jaguar Land Rover cyber incident not only disrupted operations but also exposed weaknesses across both IT and OT environments. Although no direct compromise of customer data has been confirmed, past breaches and leaked internal information increase the risks of credential theft, intellectual property exposure, and follow-on targeted attacks.
As the forensic investigation is still ongoing, the exact tactics used by the threat actors and their attribution remain unverified. Researchers, media outlets, and our own assessment indicate with medium confidence that the group ShinHhunters Collective may be responsible. However, we will await the official findings before making a definitive attribution.

RECOMMENDATIONS

Strategic Recommendations: Implement a comprehensive cyber resilience framework across IT and OT environments, ensuring regular risk assessments, supplier audits, and integration of lessons learned from industry incidents like JLR and Mitsubishi Electric SCADA vulnerabilities.

Technical Recommendations: Strengthen access controls by enforcing multi-factor authentication, regular credential rotation, and monitoring for compromised accounts; deploy advanced endpoint and network detection solutions to detect lateral movement or abnormal activity early.

Operational Recommendations: Develop and test incident response and business continuity plans that account for operational downtime, supply chain disruptions, and critical production halts; conduct employee training and simulations for cyber-attack scenarios.

Tactical Recommendations: Regularly perform tabletop exercises and red-team simulations targeting both IT and OT environments to test response procedures, validate detection capabilities, and ensure teams can quickly contain and remediate incidents similar to JLR or HELLCAT-style attacks