Vishing (Voice Phishing) Reported/alleged incident

Jaguar Land Rover cyber attack: the five-week shutdown and the disputed vishing story (2025)

JLR's 2025 cyber attack halted production for five weeks. Early reports blamed help-desk vishing; JLR's CISO later denied it. What's claimed vs what's known.

Social Engineering Examples·16 sources

The Jaguar Land Rover cyber attack stopped car production for about five weeks in 2025. JLR disclosed it on 2 September and shut systems down. A group calling itself "Scattered Lapsus$ Hunters" claimed it, and early industry reporting blamed help-desk vishing: a phone call tricking IT staff into handing over access. That story is now in doubt. In June 2026, JLR's then-CISO said no social engineering was involved, and reporting on a New York Times investigation linked the intrusion to Russian hackers. Status: Disputed method and attribution.

Key takeaways

Vishing was the early explanation. It was never confirmed, and JLR's security chief later denied it.
A claim of responsibility is evidence of a claim. Not proof.
The £1.9bn figure is a model of the hit to the UK economy, not JLR's loss.
Loans and guarantees are not losses. Don't add them up.

Timeline

Date	Event
Around 31 August 2025	Reported start of the incident
2 September 2025	JLR discloses a cyber incident and says it has shut systems down
September 2025	"Scattered Lapsus$ Hunters" claims responsibility
October 2025	Cyber Monitoring Centre models the UK economic impact
14 November 2025	JLR reports production back to normal
18 June 2026	Then-CISO Ashish Shrestha tells Infosecurity Magazine no social engineering was involved
29 June 2026	Infosecurity reports the NYT investigation's link to Russian hackers

JLR, owned by Tata Motors, employs about 34,000 people in the UK, and supports an estimated 120,000 or more jobs through its suppliers. Five weeks of stopped lines hit all of them.

Who did it? Three accounts

Account	What it says	How solid
The claim	Scattered Lapsus$ Hunters said it did it. Industry reports said help-desk vishing got them in	An attacker's claim, plus reporting. No confirmed help-desk reset, entry point or path through the network
JLR's CISO	No social engineering was involved	A named company source. He didn't say who was responsible
The NYT, via Infosecurity	Russian hackers, with Microsoft reportedly alerting JLR and new ransomware used	Anonymous sources. The original article wasn't available to check

Infosecurity also relayed the NYT's account of a separate intrusion by a Jordanian actor. That doesn't mean the two shared a way in. Treat them as possibly separate events.

Why does this matter on a social engineering site? Because the vishing version spread fast and felt right. A known group, a known playbook, a huge outage. None of that proves how an attacker got in.

Tip: when you read "hackers called the help desk", check who's saying it. The attacker? An anonymous source? The company?

The money, kept apart

Figure	What it is
£1.9bn (range £1.6bn to £2.1bn)	Cyber Monitoring Centre's model of UK-wide economic impact, using information as of 17 October 2025
£196m	Cyber-related exceptional costs in JLR's Q2 results (part of £238m total, with £42m for voluntary redundancies)
£500m	A supplier financing arrangement
Up to £1.5bn	A government guarantee supporting commercial borrowing

Financing and guarantees are not losses, and none of these are payments to victims.

One more mix-up to avoid. Two people were sentenced in July 2026 for hacking Transport for London. That's a separate case. Their convictions say nothing about who hit JLR.

What stops it

The right controls depend on how the attackers got in, which isn't settled:

If it was vishing: verify every help-desk reset through a separate channel, and use phishing-resistant MFA.
If it wasn't: patching, least privilege, network segmentation, protected backups and tested recovery plans.
Either way: plan for suppliers. A long production stop hurts far beyond your own walls.

See also vishing examples and the vishing prevention guide.

Common questions

Was the Jaguar Land Rover cyber attack caused by vishing?

Unconfirmed. Early reports blamed help-desk vishing, but JLR's then-CISO said in June 2026 that no social engineering was involved.

Who attacked Jaguar Land Rover?

Disputed. Scattered Lapsus$ Hunters claimed it. Reporting on an NYT investigation linked it to Russian hackers. JLR hasn't confirmed either.

How much did the JLR cyber attack cost?

JLR booked £196m of cyber-related costs in one quarter. The £1.9bn figure is a model of the wider UK economic impact.

How long was production stopped?

About five weeks. JLR said production was back to normal by 14 November 2025.

Sources

Two sentenced for hacking Transport for London in UK's biggest ever cyber crime case. National Crime Agency (primary), July 16, 2026. Gives the June guilty pleas and July sentences in the separate TfL case.

Statement on Cyber Incident. JLR Media Newsroom (primary). JLR's initial 2 Sep 2025 disclosure confirming the incident and system shutdown.
JLR Performance Impacted in Challenging Quarter. JLR Media Newsroom (primary). Q2 FY26 results (14 Nov 2025) disclosing £238m exceptional items, £196m cyber-related, £42m redundancy costs, confirming production had returned to normal, and explicitly documenting a £500m supplier-financing solution.
Government backs Jaguar Land Rover with £1.5 billion loan guarantee. GOV.UK / UK Department for Business and Trade (primary). Official 28 Sep 2025 announcement; describes the loan as a commercial-bank loan backed by the Export Development Guarantee, repayable over 5 years.
NCSC statement: Incident impacting Jaguar Land Rover. National Cyber Security Centre (UK) (primary). Reports NCSC support role, published 5 Sep 2025.
Jaguar Land Rover Cyber-attack (Commons debate). UK Parliament Hansard (primary). Unavailable through Exa in this run; does not establish AI voice use in this incident.
Cyber Monitoring Centre Statement on the Jaguar Land Rover Cyber Incident - October 2025. Cyber Monitoring Centre (primary). Source of the £1.9bn (£1.6-2.1bn) Category 3 estimate affecting 5,000+ organizations.
Alleged Member of Criminal Cyber Hacking Group "Scattered Spider" Arrested in Finland and Extradited to United States. US Department of Justice, USAO Northern District of Illinois (primary). Unavailable through Exa in this run. Historical citation concerns a separate alleged offense and does not establish JLR attribution.
Jaguar Land Rover production severely hit by cyber attack. BBC News (secondary). Covers the 2 Sep 2025 initial disclosure.
Jaguar Land Rover admits hackers may have taken data. BBC News (secondary). Covers the 10 Sep 2025 data-affected update.
Scattered Spider-Linked Group Claims JLR Cyber-Attack. Infosecurity Magazine (secondary). Covers the original Scattered Lapsus$ Hunters claim.
Russian Hackers Accused of Destructive Attack on Jaguar Land Rover. Infosecurity Magazine (secondary). Reports Shrestha's exact 'no social engineering was involved' quote and the 'don't involve law enforcement' detail.
A $2.5 Billion Whodunit: The Hack That Dented the U.K. Economy. The New York Times (secondary). Original unavailable through Exa in this run. A previously used DNYUZ copy is not independent corroboration or a verified licensed republication; the case now attributes relevant claims to accessible derivative reporting.
Russian hackers were behind $2.5B hack of Jaguar Land Rover: Report. TechCrunch (secondary). Reports on the NYT investigation; derivative reporting is not independent confirmation of its attribution.
JLR suppliers with 'days of cash' left, MP says. BBC News (secondary). Reports the Chambers of Commerce supplier survey figures.
Jaguar Land Rover shutdown driving suppliers to cut jobs and reduce hours - survey. Reuters (secondary). Unavailable through Exa in this run; the unverified 14% redundancy figure has not been retained.

Cite this case

Social Engineering Examples. “Jaguar Land Rover cyber attack: the five-week shutdown and the disputed vishing story (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/jaguar-land-rover-vishing-shutdown-2025

Attack Chain & Defense

1Hypothetical vishing reconstruction, not a verified JLR sequence

What happened

reconnaissance could provide staff and help-desk context for an impersonation attempt.