Jaguar Land Rover production impacted by cyberattack; Scattered Spider/ShinyHunters claims responsibility

Jaguar Land Rover production has been severely disrupted by a cyber-attack, with the company saying it took immediate action to shut down systems and is working to restart operations, while noting there is no evidence that customer data has been stolen. According to The BBC, the attack began on Sunday as the latest batch of new registration plates became available on Monday, 1 September.

The group Scattered Spider/ShinyHunters claims responsibility for the incident, a claim that has been reported in relation to the Telegraph’s coverage, though verification remains unconfirmed. JLR is owned by Tata Motors, and in its statement the company emphasised that retail and production activities have been severely disrupted but that customer data has not been shown to be stolen.

The article also recounts previous cyber incidents involving JLR, including past attacks in 2023 and 2025 and links to related exploitation scenarios around SAP NetWeaver flaws, with analysis from Onapsis cited in describing how CVE-2025-31324 and CVE-2025-42999 were used in related exploits.