6 ms·

Jaguar Land Rover hack cost UK economy an estimated $2.5B

Mgtyalx 1y ago
Does anyone know how the attack was carried out?
- giuliomagnifico 1y ago
  There aren’t many details available yet, but you can find some information here: https://treblle.com/blog/jlr-breach-breakdown-analysis https://treblle.com/blog/jlr-breach-breakdown-analysis The main issue appears to be that the attack crippled JLR’s internal systems and production databases, preventing them from manufacturing new cars because they cannot properly track parts or generate serial numbers. I’ve also read reports claiming that around 40k vehicles have already been built but are now essentially “ghost cars” since they aren’t registered in the system. Imagine what would happen if JLR had to issue a safety recall without knowing which components are installed in which vehicles.
  - alistairSH 1y ago
    Did they not have a disaster recovery plan in place? It's not amazing that they got hit with a breach. It's amazing that they couldn't just "nuke from orbit" and start with a day-old snapshot (yeah, that's massively oversimplified, but still, it shouldn't take months and $billions$ to recover either). And that 40k ghost car doesn't sound realistic. LR only makes ~400k vehicles/year. That 10% of their annual output got "lost" beggars belief.
    - onionisafruit 1y ago
      to paraphrase mike tyson, everybody has a disaster recovery plan until they get punched in the face
      - intrasight 1y ago
        They did have a good plan - which was to have the government bail them out. If you have that plan, there is no need to have any other plan.
        noir_lord 1y ago
        From their point of view it was a good plan - given JLR is owned by Tata who had the resources to bail them out and didn't they (Tata) likely see it as a good deal. Late stage capitalism in action as usual - privatise the profits, socialise the costs. Technically what the government did was underwrite the loan but again - why is the government underwriting the loan when Tata has the resources to do that (13bn net income at last FY).
- DyslexicAtheist 1y ago
  some info here https://www.cyfirma.com/research/investigation-report-on-jaguar-land-rover-cyberattack/ https://www.cyfirma.com/research/investigation-report-on-jag... > The breach was enabled through stolen Jira credentials harvested via Infostealer malware, a known hallmark of HELLCAT’s operations. The exposed data includes development logs, tracking information, source code, and a large employee dataset with usernames, email addresses, display names, and time zones. The presence of verified employee information from JLR’s global workforce raises significant concerns about identity theft and targeted phishing campaigns. then > the JLR breach escalated when a second threat actor, “APTS,” appeared on DarkForums on March 14, 2025. APTS claimed to have exploited Infostealer credentials dating back to 2021, belonging to an employee who held third-party access to JLR’s Jira server. Using these compromised credentials, the actor gained entry and shared a screenshot of a Jira dashboard as proof. APTS also leaked an additional tranche of sensitive data, estimated at around 350 GB, which contained information not included in Rey’s original dump, further amplifying the scale and severity of the breach.
- criddell 1y ago
  Unless the hack was built on zero-days, I don't like the framing of the hack costing the UK economy billions. The headline should be "Land Rover's Poor Cybersecurity and ITSEC Practices Cost UK Economy Billions", or something like that.
  - Noumenon72 1y ago
    "Victim's Lack of Martial Arts Training Caused Murder"
    - fuzzzerd 1y ago
      It works both ways, "Folks mad at bank for leaving the vault open."
    - eptcyka 1y ago
      "Victim's Lack of Locks Caused Burglary" "Victim's 3$ Padlock Invited Break In"
ZiiS 1y ago
If you wanted to shut down the line to create maneuvering room as US exports are blocked by tariffs. You could either just do it and take a massive political hit and sour relations with suppliers, or you can get a cheep 1.5 billion pound loan...
- georgefrowny 1y ago
  [dead]
crazygringo 1y ago
What was the purpose of the hack? Was it ransom they declined to pay? Did the hackers do it for the lulz? Was a nation-state testing out their capabilities?
- deleted 1y ago
  [deleted]
hollywood_court 1y ago
I don't understand how Jaguar/Land Rover is still even a thing. This is unrelated to the hack, but they consistently make the most unreliable vehicles you can buy. When I had my import repair shop, I made a fortune repairing Jags and LRs. My business partner named his lake house 'Discovery' because of all the money we made off of those things.
- globular-toast 1y ago
  It's a brand. Similar to Apple. It's just the cost of being seen with that brand and people are OK with that for some reason.
  - hollywood_court 1y ago
    Yes, but Apple generally produces a quality product that doesn't spend ~60% of its life in a repair shop.
    - skylurk 1y ago
      That's a feature. It shows you have a lot of money, if you can just light it on fire at the JLR dealer.
- frantathefranta 1y ago
  Upper middle class Americans are weirdly obsessed about LR, especially the new Defender. Jaguar I'm not sure how it survives (if it even really does nowadays).
  - hollywood_court 1y ago
    I'm definitely biased because I own Land Cruisers, but it's wild watching people throw many away on an inferior product like the Defender. I think I'd rather have a Wrangler than a Defender and that says a whole lot.
    - 1y ago
thelastgallon 1y ago
> India's Tata Motors So, all 'tech' is done by TCS?
philipwhiuk 1y ago
I don't really understand how that's possible. Here's the press release from the organisation which might be a better link: https://cybermonitoringcentre.com/2025/10/22/cyber-monitoring-centre-statement-on-the-jaguar-land-rovercyber-incident-october-2025/ https://cybermonitoringcentre.com/2025/10/22/cyber-monitorin... > This estimate is based on the information available as of 17 October and represents scenario-based analysis rather than confirmed operational data
- ncr100 1y ago
  https://news.ycombinator.com/item?id=45668372 https://news.ycombinator.com/item?id=45668372 more
- dlcarrier 1y ago
  To put it in perspective, that's more than half of the market cap of Mazda, who has several times more market share.
aquir 1y ago
Same thing happened with all companies where the IT/ERP has been outsourced to Tata Consulting Services to India...JLR, Marks and Spencer, Co-Op etc.
- eightman 1y ago
  British Airways as well. N
Mistletoe 1y ago
> In 2023, as part of an effort to "accelerate digital transformation across its business", JLR signed a five-year, £800m deal with corporate stablemate Tata Consultancy Services to provide cybersecurity and a range of other IT services. I found this hilarious in another article. Lol so you sold the company to India Tata Motors and then you went full incest and had your IT done by Tata Consultancy Services.
thehoagie 1y ago
I'm surprised this wasn't bigger news? This is the first mention but $2.5B should have been quite the headline around the world

Does anyone know how the attack was carried out?

giuliomagnifico 1y ago
There aren’t many details available yet, but you can find some information here: https://treblle.com/blog/jlr-breach-breakdown-analysis https://treblle.com/blog/jlr-breach-breakdown-analysis The main issue appears to be that the attack crippled JLR’s internal systems and production databases, preventing them from manufacturing new cars because they cannot properly track parts or generate serial numbers. I’ve also read reports claiming that around 40k vehicles have already been built but are now essentially “ghost cars” since they aren’t registered in the system. Imagine what would happen if JLR had to issue a safety recall without knowing which components are installed in which vehicles.
- alistairSH 1y ago
  Did they not have a disaster recovery plan in place? It's not amazing that they got hit with a breach. It's amazing that they couldn't just "nuke from orbit" and start with a day-old snapshot (yeah, that's massively oversimplified, but still, it shouldn't take months and $billions$ to recover either). And that 40k ghost car doesn't sound realistic. LR only makes ~400k vehicles/year. That 10% of their annual output got "lost" beggars belief.
  - onionisafruit 1y ago
    to paraphrase mike tyson, everybody has a disaster recovery plan until they get punched in the face
    - intrasight 1y ago
      They did have a good plan - which was to have the government bail them out. If you have that plan, there is no need to have any other plan.
      - noir_lord 1y ago
        From their point of view it was a good plan - given JLR is owned by Tata who had the resources to bail them out and didn't they (Tata) likely see it as a good deal. Late stage capitalism in action as usual - privatise the profits, socialise the costs. Technically what the government did was underwrite the loan but again - why is the government underwriting the loan when Tata has the resources to do that (13bn net income at last FY).
DyslexicAtheist 1y ago
some info here https://www.cyfirma.com/research/investigation-report-on-jaguar-land-rover-cyberattack/ https://www.cyfirma.com/research/investigation-report-on-jag... > The breach was enabled through stolen Jira credentials harvested via Infostealer malware, a known hallmark of HELLCAT’s operations. The exposed data includes development logs, tracking information, source code, and a large employee dataset with usernames, email addresses, display names, and time zones. The presence of verified employee information from JLR’s global workforce raises significant concerns about identity theft and targeted phishing campaigns. then > the JLR breach escalated when a second threat actor, “APTS,” appeared on DarkForums on March 14, 2025. APTS claimed to have exploited Infostealer credentials dating back to 2021, belonging to an employee who held third-party access to JLR’s Jira server. Using these compromised credentials, the actor gained entry and shared a screenshot of a Jira dashboard as proof. APTS also leaked an additional tranche of sensitive data, estimated at around 350 GB, which contained information not included in Rey’s original dump, further amplifying the scale and severity of the breach.
criddell 1y ago
Unless the hack was built on zero-days, I don't like the framing of the hack costing the UK economy billions. The headline should be "Land Rover's Poor Cybersecurity and ITSEC Practices Cost UK Economy Billions", or something like that.
- Noumenon72 1y ago
  "Victim's Lack of Martial Arts Training Caused Murder"
  - fuzzzerd 1y ago
    It works both ways, "Folks mad at bank for leaving the vault open."
  - eptcyka 1y ago
    "Victim's Lack of Locks Caused Burglary" "Victim's 3$ Padlock Invited Break In"

ZiiS 1y ago

If you wanted to shut down the line to create maneuvering room as US exports are blocked by tariffs. You could either just do it and take a massive political hit and sour relations with suppliers, or you can get a cheep 1.5 billion pound loan...

georgefrowny 1y ago
[dead]

crazygringo 1y ago

What was the purpose of the hack? Was it ransom they declined to pay? Did the hackers do it for the lulz? Was a nation-state testing out their capabilities?

deleted 1y ago
[deleted]

hollywood_court 1y ago

I don't understand how Jaguar/Land Rover is still even a thing. This is unrelated to the hack, but they consistently make the most unreliable vehicles you can buy. When I had my import repair shop, I made a fortune repairing Jags and LRs. My business partner named his lake house 'Discovery' because of all the money we made off of those things.

globular-toast 1y ago
It's a brand. Similar to Apple. It's just the cost of being seen with that brand and people are OK with that for some reason.
- hollywood_court 1y ago
  Yes, but Apple generally produces a quality product that doesn't spend ~60% of its life in a repair shop.
  - skylurk 1y ago
    That's a feature. It shows you have a lot of money, if you can just light it on fire at the JLR dealer.
frantathefranta 1y ago
Upper middle class Americans are weirdly obsessed about LR, especially the new Defender. Jaguar I'm not sure how it survives (if it even really does nowadays).
- hollywood_court 1y ago
  I'm definitely biased because I own Land Cruisers, but it's wild watching people throw many away on an inferior product like the Defender. I think I'd rather have a Wrangler than a Defender and that says a whole lot.
  - 1y ago

thelastgallon 1y ago

> India's Tata Motors So, all 'tech' is done by TCS?

philipwhiuk 1y ago

I don't really understand how that's possible. Here's the press release from the organisation which might be a better link: https://cybermonitoringcentre.com/2025/10/22/cyber-monitoring-centre-statement-on-the-jaguar-land-rovercyber-incident-october-2025/ https://cybermonitoringcentre.com/2025/10/22/cyber-monitorin... > This estimate is based on the information available as of 17 October and represents scenario-based analysis rather than confirmed operational data

ncr100 1y ago
https://news.ycombinator.com/item?id=45668372 https://news.ycombinator.com/item?id=45668372 more
dlcarrier 1y ago
To put it in perspective, that's more than half of the market cap of Mazda, who has several times more market share.

aquir 1y ago

Same thing happened with all companies where the IT/ERP has been outsourced to Tata Consulting Services to India...JLR, Marks and Spencer, Co-Op etc.

eightman 1y ago
British Airways as well. N

Mistletoe 1y ago

> In 2023, as part of an effort to "accelerate digital transformation across its business", JLR signed a five-year, £800m deal with corporate stablemate Tata Consultancy Services to provide cybersecurity and a range of other IT services. I found this hilarious in another article. Lol so you sold the company to India Tata Motors and then you went full incest and had your IT done by Tata Consultancy Services.

thehoagie 1y ago

I'm surprised this wasn't bigger news? This is the first mention but $2.5B should have been quite the headline around the world