Does anyone know how the attack was carried out?
The headline should be "Land Rover's Poor Cybersecurity and ITSEC Practices Cost UK Economy Billions", or something like that.
The main issue appears to be that the attack crippled JLR’s internal systems and production databases, preventing them from manufacturing new cars because they cannot properly track parts or generate serial numbers.
I’ve also read reports claiming that around 40k vehicles have already been built but are now essentially “ghost cars” since they aren’t registered in the system.
Imagine what would happen if JLR had to issue a safety recall without knowing which components are installed in which vehicles.
And that 40k ghost car doesn't sound realistic. LR only makes ~400k vehicles/year. That 10% of their annual output got "lost" beggars belief.
Late stage capitalism in action as usual - privatise the profits, socialise the costs.
Technically what the government did was underwrite the loan but again - why is the government underwriting the loan when Tata has the resources to do that (13bn net income at last FY).
> The breach was enabled through stolen Jira credentials harvested via Infostealer malware, a known hallmark of HELLCAT’s operations. The exposed data includes development logs, tracking information, source code, and a large employee dataset with usernames, email addresses, display names, and time zones. The presence of verified employee information from JLR’s global workforce raises significant concerns about identity theft and targeted phishing campaigns.
then
> the JLR breach escalated when a second threat actor, “APTS,” appeared on DarkForums on March 14, 2025. APTS claimed to have exploited Infostealer credentials dating back to 2021, belonging to an employee who held third-party access to JLR’s Jira server. Using these compromised credentials, the actor gained entry and shared a screenshot of a Jira dashboard as proof. APTS also leaked an additional tranche of sensitive data, estimated at around 350 GB, which contained information not included in Rey’s original dump, further amplifying the scale and severity of the breach.