Breaches and incidents
Jaguar Land Rover / Tata Motors (India): cyberattack halts JLR production for about five weeks, data stolen, GBP 196m quarterly cost
Tata Motors filed JLR’s statements to the exchanges from 1 Sep 2025 (“global IT issues impacting our business”), through the 29 Sep update on phased...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Tata Motors filed JLR’s statements to the exchanges from 1 Sep 2025 (“global IT issues impacting our business”), through the 29 Sep update on phased restart, to the 7 Oct restart announcement. BleepingComputer reports JLR confirmed data was stolen, production restarted around 8 Oct, the attack cost GBP 196m in the Jul to Sep quarter, and the UK government approved a GBP 1.5bn loan guarantee on 29 Sep. JLR introduced manual supplier payments and cash-up-front for suppliers.
- Root cause: not disclosed by JLR.
- Attacker: Scattered Lapsus$ Hunters claimed it on Telegram (BleepingComputer). In Jun 2026 TechCrunch, citing the New York Times, reported Russian hackers were behind it, with Microsoft alerting JLR, and a second intruder “Rey” also in some networks.
- Response: worked with NCSC and law enforcement; phased restart; NSE sought clarification from Tata Motors on 25 Sep over cost reports.
Sources
- https://nsearchives.nseindia.com/corporate/TATAMOTORSSJS_01092025221408_NSEBSEJLR.pdf
- https://nsearchives.nseindia.com/corporate/TATAMOTORSSJS_29092025150434_NSEBSEJLRUPDATE.pdf
- https://nsearchives.nseindia.com/corporate/TATAMOTORSSJS_07102025152752_NSEBSEJLRUPDATE.pdf
- https://www.bleepingcomputer.com/news/security/jaguar-land-rover-cyberattack-cost-the-company-over-220-million/
- https://techcrunch.com/2026/06/26/russian-hackers-were-behind-2-5-billion-hack-of-jaguar-land-rover-report/