A former UK defence minister has publicly confirmed that the cyber-attack which crippled Jaguar Land Rover (JLR) in 2025 was state-sponsored. This marks the first official acknowledgement that a hostile foreign power orchestrated the breach.
The catastrophic hack cost an estimated £1.6bn to £2.1bn, making it the most expensive cyber-incident in British history by a wide margin.
The attack forced the luxury car manufacturer to stop production, putting 200,000 jobs into jeopardy as operations stopped for five weeks. It impacted roughly 5,000 organisations, including local showrooms, repair shops, and thousands of small parts manufacturers.
Al Carns, who served under ex-Prime Miniter Keir Starmer as a defence minister until his resignation in June, revealed the state-sponsored nature of the attack during an address at the Chatham House think tank. Discussing the national approach to resilience and threat deterrence, Carns pointed to a lack of coherent public communication regarding national security threats, stating:
“We know there is £15bn of cyber-attacks, we know there’s espionage going on… We know the Jaguar Land Rover attack was state-sponsored.” he said
Reports of the Potential Attacker
While previous investigative reports from outlets like The New York Times pointed toward Russian hacker groups, and The Telegraph highlighted early suspicions regarding Moscow, the government had previously refused to officially name the culprits. Mr Carns later clarified that his remarks were not based on an official Ministry of Defence assessment, though he noted that an attack of that magnitude could hardly occur without the host state’s knowledge.
Microsoft, who had reportedly been tracking the Russian group responsible, apparently alerted Jaguar to who had breached their systems. The encryption used by the attack group has been described as really complicated.
Political Backlash
A shadow defence minister, David Reed, criticised the government for keeping the public in the dark, arguing that failing to hold hostile states to account sends a dangerous message of weakness. The revelation also arrives amid heightened anxiety over UK cyber resilience.
Prime Minister Andy Burnham recently urged the public to stockpile emergency supplies following widespread technical disruptions. This admission places renewed pressure on the British government to address escalating state-backed cyber threats.
Image: Mathias Reding 
Source: Cyber Security Intelligence