UK Government Backs Jaguar Land Rover With 1.5B Pound Loan

The British government will guarantee a 1.5 billion pound loan to Jaguar Land Rover as the embattled carmaker grapples with the fallout of a September cyberattack that froze production and sales across the globe.

See Also: Strengthening Your Security Program With Open API

The U.K. government on Sunday said it will offer a loan guarantee of roughly $2 billion to the luxury carmaker. A breach detected Sept. 1 prompted the company to shut down production lines in the United Kingdom, Slovakia, Brazil and India (see: Jaguar Land Rover Extends Production Halt).

A government official said the loan amount, underwritten by export credit agency U.K. Export Finance, is necessary to help “support the supply chain and protect skilled jobs in the West Midlands, Merseyside and throughout the U.K.”

The Tata Motors-owned brand is reportedly set to begin a phased restart of operations on Oct. 6, after more than a month of breach-induced idleness causing losses adding up to billions of pounds. A cybercrime group consisting principally of Western adolescent hackers with the moniker “Scattered Lapsus$ Hunters” has taken responsibility for the hack (see: Jaguar Land Rover Hackers Stole Data).

Jaguar Land Rover will shoulder the full bill of losses and recovery since it lacks cyber insurance, the Financial Times reported. As the attack’s duration turned from days into weeks, concerns surfaced about the economic impact to the automaker’s workforce and its network of suppliers – personnel who collectively number 130,000, according to the BBC. Other estimates put the number of affected supply chain workers at 200,000.

“Jaguar Land Rover is not just a carmaker,” said Liam Byrne, Member of Parliament for Birmingham Hodge Hill and Solihull North and chair of the Commons Business and Trade Committee. The carmaker “is the heart of our advanced manufacturing, the anchor of a vast supply chain, and a cornerstone of both our regional and national economy,” he said.

The loan guarantee came after Business and Trade Secretary Peter Kyle visited Jaguar Land Rover headquarters in Gaydon and sunroof manufacturer Webasto on Saturday.

The government assistance indicates the hack endangered “national economic security,” said Lucas Kello, associate professor of international relations at the University of Oxford. “It’s meant to keep cash flowing to suppliers so that a company level breach doesn’t cascade into an industrial shock. The state is stepping in to stop a factory disruption from becoming a growth-and-jobs crisis,” Kello told Information Security Media Group.

British and U.S. police have arrested a number of Scattered Spider members, in some cases obtaining significant prison sentences. One subset of Scattered Spider apparently behind the Jaguar Land Rover attack declared in a semi-coherent screed on Sept. 12 that they would “go dark,” an assertion that generated skepticism among cybersecurity experts. The group is not a hierarchical operation but “a loose but well-organized network of threat actors who share tactics and often collaborate in real-time via online forums and chat platforms,” as Quorum Cyber describes it. The arrest or imprisonment of some individuals may not deter others in the same collective from continuing to hack.

Analysis by security firms Cyfirma and Hudson Rock found a hacker, going by the moniker “Rey” linked to the HellCat ransomware group, apparently hacked the car manufacturer by using credentials of Jira bug tracker software stolen through infostealer malware infections. Days after Rey posted onto a criminal breach forum about 700 files belonging to Jaguar Land Rover, another hacker going by “APTS” claimed to have access to the carmaker’s JIRA server via credentials taken by an infostealer in 2021. That hacker leaked about 350 gigabytes of data that contained data not found in Rey’s tranche of documents, Cyfirma said.

Labour MP Byrne told the BBC he believes Jaguar Land Rover suppliers may need additional government support, “something like a Covid-style loan, for example.”

With reporting from Information Security Media Group’s Mathew J. Schwartz in Scotland and David Perera in Northern Virginia.