Ex-UK defence minister Carns says JLR cyberattack was state-sponsored

Carns spoke at a Chatham House event in July 2026, a month after resigning his ministerial post. He told The Telegraph afterwards that his comments were not based on an official Ministry of Defence assessment of the attack.

The remark came during a question about “resilience and deterring threats in the absence of political leadership”. Carns said: “We know the Jaguar Land Rover attack was state-sponsored, etc, etc.” He added that it “would be highly unlikely for an attack of that scale to emanate from anywhere without the host state knowing about it”. The Telegraph reported at the time of the attack that Russia was suspected, but no final assessment was made public. A government spokesman said: “We do not routinely comment on ongoing investigations or operational activity.” The New York Times reported in June that a group of Russian hackers was responsible, according to five people familiar with an investigation into the hack. David Reed, a shadow defence minister, told The Telegraph that Britons “deserve answers” and said the government had kept the public in the dark.

The cost and the caveat

The Cyber Monitoring Centre modelled the total UK financial impact at £1.9bn, within a range of £1.6bn to £2.1bn. It classified the incident as a Category 3 systemic event and called it the most expensive in British history “by some distance”. The centre said the figure was scenario-based analysis, not confirmed operational accounting. It estimated the incident materially affected more than 2,700 UK organisations, while The Telegraph reported that some 5,000 organisations were affected, including car showrooms, repair shops and parts suppliers. UK output dropped by close to 5,000 vehicles per week during the halt, the centre said. The government provided an emergency £1.5bn loan guarantee to keep the supplier base alive, according to an analysis by shattered.io.

JLR estimated the production stoppage cost £260m ($351m). It reported a £244m ($330m) loss for the fiscal year ending in March, against a £1.8bn ($2.4bn) net profit in 2024-25.

Five weeks of stopped lines

The attack began around 31 August 2025, according to an analysis by shattered.io. By 1 September 2025, JLR confirmed a breach of its internal IT environment and shut down global IT systems to contain the intruder. That containment step, standard incident-response practice, stopped assembly lines because JLR runs a heavily digitised, just-in-time operation. Plants at Solihull, Halewood and Wolverhampton went dark, along with Nitra in Slovakia and operations in Brazil and India.

JLR first extended the suspension to 24 September, then again to 1 October 2025, before a controlled, phased restart through October. The company said its teams worked “around the clock” with cybersecurity specialists, the National Cyber Security Centre and law enforcement.

Who claimed the attack

Responsibility was claimed on Telegram by a group calling itself Scattered Lapsus$ Hunters, which posted screenshots it said came from JLR’s internal systems. JLR did not officially confirm attribution, and forensic analysts including CYFIRMA cautioned that exact tactics and attribution remained unverified while the investigation continued. The group’s playbook relied on SIM swapping, help-desk impersonation, MFA fatigue and stolen credentials rather than exotic malware, the analysis said.