Cyberattack on Jaguar Land Rover: global production still at a standstill
![Image [Roads of surveillance]. 6– Policies, Laws and Responses: Who Regulates Surveillance?](https://incyber.org//wp-content/uploads/2026/02/media-episode-5-885x690.png)
Jaguar Land Rover (JLR) announced on 16 September 2025 that its production, halted following a cyberattack, would not restart before 24 September. After detecting a malicious intrusion during the night of 31 August to 1 September, the group decided to “proactively shut down” its IT systems in order to “restart global applications in a controlled manner.”
This global outage has led to the suspension of production lines, vehicle registrations, and the company’s entire supply chain. Most JLR factory workers and employees have therefore been placed on temporary layoff. Daily revenue losses are estimated at between £5 million and £10 million (€5.8 million to €11.6 million).
The attack was claimed by Scattered Lapsus$ Hunters, a cybercriminal consortium made up of members from the English-speaking groups Scattered Spider, Lapsu$, and Shiny Hunters. The gang recently announced it would pause its activities to “enjoy its golden parachutes.”