Jaguar Land Rover says cyber-attack has affected ‘some data’

The cyber-attack on Jaguar Land Rover has affected data held by the carmaker, it has said, as its factories in the UK and abroad face prolonged closure.

JLR, Britain’s biggest carmaker, said on Wednesday that in its investigations into the hack, which first emerged last week, it had now discovered data had been breached.

The manufacturer said it could not provide more details of which data was affected, or if customers’ or suppliers’ information was stolen, but said it would be contacting anyone affected.

A spokesperson said all the relevant authorities had been notified, understood to include the Information Commissioner’s Office, which had already been informed of the risk of a data breach.

The costs of the cyber-attack will be mounting swiftly for JLR, which is owned by India’s Tata group. Production at factories in the Midlands and Merseyside in the UK was already on hold until at least Thursday, and workers have now been told they will be unable to return until at least next Monday. Other production facilities around the world are also on pause, amid speculation that it could be weeks until systems are operational.

Suppliers and retailers for JLR are also affected, some operating without computer systems and databases normally used for sourcing spare parts for garages or registering vehicles.

A spokesperson for JLR said: “Since we became aware of the cyber incident, we have been working around the clock, alongside third-party cybersecurity specialists, to restart our global applications in a controlled and safe manner.

“As a result of our ongoing investigation, we now believe that some data has been affected and we are informing the relevant regulators. Our forensic investigation continues at pace and we will contact anyone as appropriate if we find that their data has been impacted.

“We are very sorry for the continued disruption this incident is causing and we will continue to update as the investigation progresses.”

A group of English-speaking hackers, linked to other major hacks this year on retailers including M&S, have claimed responsibility for the JLR attack. Screenshots purporting to be of JLR’s internal IT systems were posted on a Telegram channel that combined the names of groups of hackers known as Scattered Spider, Lapsus$ and ShinyHunters.