M&S hackers claim to be behind Jaguar Land Rover cyberattack

Scattered Lapsus$ Hunters claim responsibility for recent cyberattack on Jaguar Land Rover
The group shared screenshots allegedly taken from inside JLR’s IT network
An investigation is under way

Scattered Lapsus$ Hunters – a hacking collective apparently made from the merger of three notorious cybercrime groups has claimed responsibility for the recent cyberattack on Jaguar Land Rover (JLR).

The luxury car maker reported suffering a cyberattack which “severely disrupted” its production and retail activities, as two plants were temporarily shut down, and employees sent home, as JLR’s IT team grappled with the attackers and sought to regain control over compromised endpoints.

The group has now been spotted apparently bragging about the attack on Telegram, sharing screenshots apparently taken from inside JLR’s IT infrastructure. They also seem to be cracking jokes about the breach, asking “Where is my new car, Land Rover?” and similar.

Teens joining forces

The hackers shared a few screenshots as proof of their claims, which seem to be showing internal instructions for troubleshooting a car charging issue, as well as internal computer logs.

However, the crooks did not confirm if they actually stole any files, or managed to deploy any malware, and cybercriminals are often keen to exaggerate their claims.

Jaguar Land Rover was said to be looking into the claims.

Scattered Lapsus$ Hunters is a patchwork of three groups – Scattered Spider, Lapsus$, and ShinyHunters.

Each of these are infamous in their own right, being responsible for some of the biggest and most disruptive ransomware attacks, data breaches, and malware deployments. However, it seems they joined forces recently, as this is now yet another in a string of attacks, after Allianz Life, M&S, and others.

Very little is known about the miscreants. Some researchers believe they are teenagers, probably living in the US or the UK. It was also said they are trying to extort JLR for money, but these reports are unconfirmed at this time.