A Hack Too Far? Report Ties Russia to Jaguar Land Rover Hit

•
June 26, 2026    

Suggestions that Russian attackers disrupted British automotive giant Jaguar Land Rover raise the question of how the British government might respond, especially if it confirms Kremlin involvement.

See Also: Beat the Breach: Outsmart Attackers and Secure the Cloud

Multiple people with knowledge of the Jaguar Land Rover investigation say law enforcement agencies and private cybersecurity firms probing the breach, which involved ransomware being unleashed inside the automaker’s network, have concluded that it traces to Russian attackers, The New York Times first reported Friday. That’s despite the Western adolescent hacking collective Scattered Lapsus$ Hunters, on its Telegram channel, having quickly claimed credit for the attack.

If Russian attackers instead perpetrated the hit, experts said it suggests Moscow is advancing its use of cyber “gray zone” tactics designed to destabilize adversaries, including Ukrainian allies, while attempting to stop short of geopolitical “red lines” that could provoke a harsh response.

“I’m not surprised that Russia will find innovative ways of making life difficult for the government, for national critical infrastructure, for anyone that has done things on behalf of Ukraine. It aligns geopolitically with what we’ve seen with Russian operations in that gray zone,” said Ian Thornton-Trump, CISO of cybersecurity firm Inversion6.

The attack against Jaguar Land Rover began on Aug. 31, 2025, forcing the automaker to take its systems offline. Ultimately, the attack and recovery disrupted production across the company’s factories in Britain, Brazil, China, India and Slovakia. Operations resumed in October 2025, but production levels didn’t return to normal until the following month. The disruption affected more than 5,000 British firms, cost Jaguar Land Rover $260 million and took an estimated $2.5 billion bite out of the British economy.

In the days after the breach, Microsoft first alerted Jaguar Land Rover that a Russian group it was tracking appeared to be behind to the attack, The New York Times reported, citing only anonymous sources. That followed The Telegraph in October 2025 reporting that investigators were probing the Russian state’s potential involvement in the hack.

The evidence that reportedly led investigators to conclude that the attack has Russian fingerprints wasn’t detailed in the Times report, which makes it difficult to assess. So too do questions about whether the Russian state perpetrated the attack, or if it potentially used cybercriminals as proxies.

Experts warn that it’s all too easy for attackers to leave false flags. “Evidence has to be irrefutable when considering a nation-state response,” Thornton-Trump said.

Perhaps, British intelligence does have iron-clad attribution that the Kremlin used a proxy to hack Jaguar Land Rover, but it’s based on top secret evidence and investigators can’t reveal their information-gathering methods. What options does the U.K. government really have to respond to Russia?

“I suspect much of what the government can do is shout this as loudly as they can – warn the public and, more importantly, critical business and infrastructure providers that it is a real and present danger, and that everyone needs to be on guard. More so perhaps than they have been,” said cybercrime expert Alan Woodward, a visiting professor at England’s University of Surrey.

“It’s already started as a repeated message,” including from Britain’s National Cyber Security Centre, he said. “Whether the intended audience is paying attention has yet to be proven.”

While there’s a long-noted nexus between the Russian state and cybercrime groups, including players such as Evil Corp, proving that Moscow sanctioned the attack would be much more difficult to prove (see: Kremlin Shaping Cybercrime Into Deniable Geopolitical Tool).

For years, analysts have charted links between Moscow and Russian cybercriminals. Especially since the start of Russia’s all-out invasion of Ukraine, this information warfare has expanded to include many different tactics, including cyberattacks. “Russia is testing us in the gray zone with tactics that are just below the threshold of war,” often boiling down to “attempts to bully, fear monger and manipulate,” said Blaise Metreweli, the chief of Britain’s Secret Intelligence Service, better known a MI6, in a rare public speech last December.

Such tactics have included arson attacks, sabotage, cutting undersea cables, drone incursions, distributed-denial-of-service attacks, data leaks and more.

Russia’s aim is to destabilize its adversaries. “They’ve worked out that the most effective way is not to confront us directly but to quietly hollow us out,” said Dan Jarvis, Britain’s minister of state for security, in an April speech at the NCSC’s CyberUK conference in Scotland (see: UK: Russian Hacking Reaches New Levels of Hostility).

Jarvis pointed to the Jaguar Land Rover attack as an example of the damage that can be wrought through cyberattacks.

“If this damage had been caused by an old-school, physical attack it would have been the equivalent of hundreds of masked criminals turning up to dealerships across the country breaking glass, smashing up computers and driving cars right off the forecourt,” he said.

The message for businesses: If you don’t think your enterprise is in play, geopolitically speaking, you’re wearing blinders.

These attacks may not always involve willing proxies. Yaroslav Vasinskyi, a former affiliate of ransomware group REvil who’s known as “Rabotnik,” told threat intelligence firm Analyst1 that while he pleaded guilty in U.S. court to perpetrating the July 2021 supply-chain attack against Kaseya, which disrupted 1,500 businesses, that he was forced to do the hacking by Russian intelligence (see: Breach Roundup: REvil Hacker Gets Nearly 14-Year Sentence).

“His willingness to speak has given us a rare window into a side of ransomware we rarely see, where coercion, fear and state interests blur the lines between perpetrator and pawn,” Analyst1 said, adding that Russian intelligence agencies may have a direct role in who ransomware groups’ are targeting.

Unexpected levels of damage and fallout can also occur. “As hostile nations do operate through criminal groups as proxies, just as happened in the Cold War with the use of mercenaries, they sometimes go well beyond what the nation state intended. Maybe it’s a lesson such hostile nations need to learn – you cannot always control such proxies, so it’s best not to use them,” Woodward said.

“However, some national leaderships are more arrogant than others and think they can maintain control, only later to realize they have to take direct action to neuter them,” Woodward said.