English-speaking hackers force Jaguar Land Rover to halt production at key UK sites

Jaguar Land Rover has been forced to shut down production at major plants after a cyber-attack claimed by hackers linked to the Marks & Spencer breach paralysed the carmaker’s IT systems.

Britain’s biggest automotive manufacturer confirmed on Monday that its manufacturing and retailing operations had been “severely disrupted” by the incident, prompting an immediate halt at key sites. Although the company insisted there was no evidence of customer data theft, it said systems were shut down “proactively” to contain the damage.

A group of English-speaking hackers appeared to claim responsibility through a Telegram channel combining the names of three notorious collectives: Scattered Spider, Lapsus$ and ShinyHunters. The channel posted screenshots it said were taken from Jaguar Land Rover’s internal systems alongside media reports of the hack.

Scattered Spider is a loose network of mostly teenagers and young adults already blamed for attacks on retailers including M&S, Co-op and Harrods earlier this year. Four suspects, three of them teenagers, were arrested in July at UK addresses as part of an ongoing investigation.

Security researcher Aiden Sinnott of Sophos noted that one persona active on the Telegram group shared a name with a member of Hellcat, a ransomware gang that previously claimed to have extracted data from JLR. He argued that Hellcat resembled the same demographic as Scattered Spider and ShinyHunters: young, English-speaking hackers who thrive on social media exposure.

“They speak English and they are keen on using social media channels,” Sinnott explained, adding that groups such as Lapsus$ share the same tactics and appeal to similar demographics.

Car industry sources warned the disruption could ripple far beyond JLR. Suppliers accustomed to making just-in-time deliveries of parts have been hit hard, with potential losses running into tens of millions of pounds during the stoppage.

The cyber-attack comes at a turbulent time for the manufacturer. Already reeling from US tariffs and shrinking sales, JLR reported a 49% drop in underlying pre-tax profits to £351m for the three months to June. That period included a pause on exports to the United States, compounding its financial strain.

The National Crime Agency confirmed it was investigating. “We are aware of an incident impacting Jaguar Land Rover and are working with partners to better understand its impact,” a spokesperson said.

The Coventry-headquartered carmaker employs nearly 33,000 people across 17 UK sites, making it one of the country’s most significant industrial employers. The halt in production underscores how vulnerable large manufacturers have become to cyber-attacks that target IT infrastructure rather than physical plants.

Scattered Spider in particular has become a byword for disruption in the retail and technology sectors. Analysts say the name is less a formal group than an umbrella term describing a demographic: late-teen and twentysomething hackers who collaborate loosely online, often via Telegram. Unlike the highly structured ransomware syndicates traditionally based in Russia and eastern Europe, these English-speaking collectives operate more chaotically, blending mischief with profit-driven attacks.

Lapsus$ has a similarly notorious history. In 2023, British teenager Arion Kurtaj, an autistic member of the group, was handed an indefinite hospital order after leaking footage from the unreleased Grand Theft Auto 6 game in one of the most high-profile breaches of its kind. ShinyHunters, meanwhile, has a French connection: member Sebastien Raoult was sentenced in the US last year to three years in prison for his role in data thefts.

Consolidating these hackers under one banner is difficult, Sinnott stressed, because they are essentially individuals or small crews who sometimes collaborate but often operate independently. Still, the Telegram channel’s claims highlight the porous boundaries between them.

For Jaguar Land Rover, the fallout is immediate and costly. As engineers work to restore its crippled systems, suppliers and workers face the uncertainty of an enforced pause. With profits already under pressure, the incident adds a new layer of instability to Britain’s flagship carmaker