Investigators are now suggesting that a Russian collective may be behind the cyberattack that targeted Jaguar Land Rover (JLR) and incurred costs of £1.9 billion for the UK. This assessment marks a shift from initial suspicions, which pointed towards a hacking group including individuals based in the UK.
Private-sector cyber-response specialists, alongside law enforcement officials from Britain and the United States, have indicated that the motivation and methods employed in the attack do not align with those of the initially suspected hacking group, according to The New York Times. Authorities have reportedly been examining potential Russian involvement since at least October and recently concluded that the attackers originated from the country. It remains unclear whether the attack was sanctioned by the Kremlin or if the hackers acted independently.
Microsoft had been monitoring the Russian group and informed Jaguar Land Rover of the breach. Experts investigating the case noted the use of a novel type of ransomware with a unique encryption algorithm, which one described as "mind-blowing."
Impact of the Attack
The cyberattack, which occurred last year, led to a production shutdown at JLR's UK plants, with factory workers being sent home. The incident also disrupted the car manufacturer's dealer network, hindering its ability to register new models during a peak sales period. Parts suppliers expressed concerns about the impact on their businesses, with some reportedly entering "panic and recovery mode."
Jaguar Land Rover issued a statement thanking customers, partners, suppliers, and colleagues for their patience and support, while apologizing for the disruption. Dealers faced challenges accessing online systems, necessitating a more manual process for registering new vehicles. The attack affected thousands of existing owners as well, with garages unable to provide repairs due to the IT shutdown impacting JLR's parts supply chain.
In response to the financial strain on suppliers, the government provided JLR with a guarantee on a $2 billion (£1.5 billion) loan intended to support these businesses.
Broader Context of Russian Cyber Activity
Western security agencies identify Russia as a significant perpetrator of global cybercrime, with its intelligence services frequently employing hackers for attacks. This development follows the UK's imposition of sanctions on the Russian hacking syndicate Evil Corp, which was operating out of Moscow.
Recent months have seen heightened tensions between Britain and the Kremlin, including an incident in the English Channel where a Russian warship fired shots near a British couple on a yacht. The couple reported that the Russian frigate did not appear on their Automatic Identification System, lacked visible identification, and made no attempt to radio them. This event occurred as G7 leaders convened for talks that included Russia's war in Ukraine.
The Russian vessel involved was observed operating near British waters, escorted by Royal Navy patrol vessels before the encounter with the yacht.
Britain's National Crime Agency and National Cyber Security Centre, along with the FBI, Palo Alto Networks, and Google's Mandiant unit, collaborated to assist JLR in its investigation following the attack. The methods employed were deemed distinct from those used by hackers suspected to be organized by the group Scattered Spider in earlier attacks on Harrods and M&S.