Russian Hackers Linked to $2.5 Billion Jaguar Land Rover Cyberattack

Quick Facts

• The cyberattack on Jaguar Land Rover began Aug. 31, 2025, halting production for five weeks across plants in the UK, Brazil, China, India, and Slovakia.
• The Cyber Monitoring Centre estimates the attack cost the UK economy £1.9 billion (roughly $2.5 billion), making it a Category 3 systemic event surpassing WannaCry’s 2017 damage.
• Microsoft tracked the Russian hacking group and alerted JLR to the attackers’ identities; the UK government has not yet made an official attribution.

Investigators have linked the most destructive cyberattack in British economic history to Russian hackers. Citing people close to the investigation, The New York Times reported on June 26, 2026, that hackers behind the Jaguar Land Rover breach were Russian, though it remains unclear whether they acted on direct Kremlin orders, operated as independent criminals, or something in between.

Microsoft had been tracking the group and provided JLR with information about the hackers’ identities. The FBI, Britain’s National Crime Agency, the National Cyber Security Centre, Google’s Mandiant unit, and Palo Alto Networks all contributed to the investigation.

How the Attack Unfolded

The breach started simply. Attackers used phishing emails and phone calls to gain access to JLR’s internal systems. No advanced exploits were required. By Sept. 1, 2025, JLR had paused production. By Sept. 22, all production lines had stopped entirely, with workers told to stay home.

Operations resumed in October 2025, but production did not return to normal until November. JLR’s direct cost from the disruption reached $260 million. The company posted a pre-tax loss of £485 million for the July-September 2025 quarter, compared with a profit of £398 million for the same period the prior year.

Wholesale volume fell 43% to 59,200 units during the three-month period ending Dec. 31. Retail volume dropped 25% to 79,600 units in the same quarter.

Systemic Economic Damage

The Cyber Monitoring Centre designated the incident a Category 3 systemic event, its highest tier. The attack rippled through more than 5,000 British businesses. The Bank of England later cited the breach as a partial cause for GDP growth of just 0.2%, below its earlier projections.

The CMC’s £1.9 billion estimate of damage to the UK economy exceeds the economic toll from the 2017 WannaCry attack on British institutions. Losses to JLR alone ran an estimated £50 million per week during the shutdown.

Multiple Intruders, One Network

The Russian group was not alone inside JLR’s systems. A Jordanian hacker known as “Rey,” tied to the HELLCAT ransomware group, had separately broken in earlier in 2025. Rey leaked roughly 700 internal documents using stolen Jira credentials obtained through infostealer malware.

A third actor called “APTS” claimed access through credentials compromised since 2021 and leaked an additional 350 gigabytes of sensitive data not included in Rey’s dump. The simultaneous presence of multiple unrelated threat actors inside one network reflects a pattern investigators have flagged across recent high-profile breaches.

Oversight Questions

JLR had no cyber insurance at the time of the attack, despite reporting over £5 billion in liquidity and £2.5 billion in pre-tax profits the prior fiscal year. The company had outsourced its cybersecurity to Tata Consultancy Services, a firm previously linked to other significant breaches. Both decisions have drawn scrutiny from investigators and industry observers.

Investigators view the operation as possible retaliation for UK support of Ukraine, though no formal public statement has confirmed state sponsorship. The chain of command between the hackers and the Kremlin remains officially unresolved.

For software and technology companies, the attack reinforces a basic risk: sophisticated, state-linked intrusions often begin with a phone call and a set of credentials no one thought to revoke.

Read more: Russian hackers were behind $2.5B hack of Jaguar Land Rover: Report