Kevin Beaumont
Jaguar Land Rover have extended their car production shutdown for at least another week: https://www.bbc.com/news/articles/c15kpxnn2p2o
There’s a curious and unsourced line at the end of the BBC article: “JLR is currently taking the lead on support for its own supply chain, rather than any state intervention.”
If so, why are suppliers laying off staff and calling for government intervention?
Kevin Beaumont
Jaguar Land Rover have contained their network and stopped production after what appears to be a ransomware incident. VPNs and network border in UK all down.
Kevin Beaumont
Jaguar Land Rover moved their cybersecurity and IT functions to TCS two years ago 🫡
Kevin Beaumont
Jaguar Land Rover is ransomware, I can see network traffic from infrastructure used by multiple e-crime groups over the past week.
They (JLR) appear to be doing contain to eradicate, i.e. all UK border services shut, Windows infrastructure offline etc.
J$
@GossiTheDog JLR allowed Windows in their infrastructure. Those seeking to celebrate the same achievements should follow the lead.
The rest of us: keep the leper colony at bay.
翠星石
Christoffer S.
@GossiTheDog Cheap will almost always prevail, until it doesn't.
Kevin Beaumont
Jaguar Land Rover latest from the outside looking in.
AS205756 aka JAGUAR LAND ROVER AUTOMOTIVE PLC is shut down - UK network only (however it hosts their most important infrastructure).
Staff have been told not to turn up to manufacturing facilities.
Tata Motors (parent company) appears to be online still but looks like a mess on Shodan, e.g. lots of SAP Netweaver boxes dangling directly off the internet.
Mark Koek
@GossiTheDog Did a Red Team against a TCS-run SOC once. So easy it wasn’t even funny.
apth
@GossiTheDog I would love to hear a little bit about what you're using to see that network traffic, as an aspiring CTI nerd
Alameals
@GossiTheDog Any claimed responsibility for this yet?
Kevin Beaumont
JLR - network border all still offline. Liverpool Echo reports factory production still at all stop.
Alex
@GossiTheDog they must like the party van.
Kevin Beaumont
The lapsus$ guys are taking credit for the Jaguar Land Rover thing, speed run to see how many times they can get v&'d in 5 years.
Alex
@GossiTheDog these kids have no idea how badly they're ruining their future. I have a misdeamnor cuz I took a plea deal and I still got majorily fucked. I bet they think becoming infamous like the kids in the 90's and early 2000's will make them rich and famous while landing jobs with zero effort.
Alex
@GossiTheDog o_O
Kevin Beaumont
I can see ecrime infrastructure was talking to this at JLR https://beta.shodan.io/host/185.193.35.39
It's a SAP Netweaver box. The Lapsus$ kids have been running around with a SAP exploit for a while, prior thread reference: https://cyberplace.social/@GossiTheDog/115005311849134541
Alex
@GossiTheDog imagine bragging about this being so easy when they probably bought the exploit with bitcoin.
Kevin Beaumont
The lapsus$ guys also posted this screenshot, on an internal Jaguar Land Rover SAP box last night:
Jon PENNYCOOK
@GossiTheDog have they really still got servers in the ford.com domain after all these years?
Kevin Beaumont
The lapsus guys continue to go nuts on IRC^H^H^HTelegram https://www.bbc.co.uk/news/articles/c4gqepe5355o
Kevin Beaumont
To back up ReliaQuest - this is the exploit LAPSUS guys have running around with on SAP Netweaver, just had a look this evening after acquiring the exploit. https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
There’s a metric ton - over 5 figures - of these boxes directly internet facing. Worse; from version printing, less than 5% are patched for the two CVEs being exploited.
Kevin Beaumont
Liverpool Echo reports Jaguar Land Rover production still isn't running, with factory stop told to stay at home, and report it impacts all manufacturing locations. https://www.liverpoolecho.co.uk/news/liverpool-news/update-jaguar-land-rover-shut-32411513
Separately, the network border is also still offline (I have monitoring in place to see when they come back online).
Kevin Beaumont
If anybody runs into a LAPSUS$ incident at their org hit me up on Signal, I can try to help profile their MO as been there, done that.
They'll frequently not even bother to deploy ransomware, they'll also do crazy things (and like to write about poo, and send people poo packages in the mail). It's basically like fighting Mr Bean, who is also good at computers.
Kevin Beaumont
This isn't anything against the LAPSUS guys btw as they're basically having a five year ninja fight with Mandiant, DART, cyber standards and law enforcement while playing teenage Mr Bean and lets be honest... that's pretty funny and eye opening.
Kevin Beaumont
ITV reports Jaguar Land Rover has shut down car production in the UK, Slovakia, China, India and Brazil.
https://www.itv.com/news/2025-09-04/jaguar-land-rover-temporarily-halts-all-car-production-following-cyber-attack
Gary :party_porg:
Stephan
@GossiTheDog That does not sound like ransomware any more. That sounds like an SAP migration.
Kevin Beaumont
ITV News 6pm lead story on Jaguar Land Rover
Key take away is anonymous source at JLR saying they may need UK government support for motor sector off the back of the incident.
Just_Patch_It
@GossiTheDog well I’m glad I don’t have that shit hanging off my edge.
Kevin Beaumont
JLR is keeping all factory production suspended today, tomorrow, Sunday and at least Monday (possibly longer) in UK, Slovakia, China, India and Brazil.
https://www.liverpoolecho.co.uk/news/liverpool-news/jaguar-land-rover-staff-until-32413174
Kevin Beaumont
JLR direct employ 32k people in the UK so I imagine there's going to be ripple effects on the wider economy off the back of this one the longer it goes on.
Kevin Beaumont
Meanwhile the LAPSUS guys were busy posting large numbers of US defense Top Secret marked documents last night. They've seen been deleted from Telegram.
Greem (Graeme. Not Graham!)
@GossiTheDog the docs, or the LAPSUS folks?
Kevin Beaumont
One surprising thing with the Jaguar Land Rover incident - they've only isolated JAGUAR LAND ROVER AUTOMOTIVE PLC (AS205756), the UK network. The India, China etc networks are still online.
When I dealt with LAPSUS elsewhere they entered via a different country network/biz unit and then pivoted to target country/biz unit.
Seven
@GossiTheDog this whole event is... extra.
But you caught me with the IRC^H^H backspace.
Kevin Beaumont
JLR UK have got one internet facing system back online - wslx.jlrext.com
Single factor auth only because that's how automotives roll. If you visit direct IP, it's still branded Ford - Ford sold the business in 2008.
Kevin Beaumont
Just checked in on JLR - factory production won't be resuming tomorrow (day 7).
Kevin Beaumont
Jaguar Land Rover car production is still shut down tomorrow, day 8. I’ve checked the network border, everything except one system in UK is also still offline.
Just_Patch_It
@GossiTheDog that’s $40 million gone poor, just in sales profits.
Kevin Beaumont
JLR are keeping car production closed until least this weekend. They also say “some data was impacted”, whatever that means.
https://www.liverpoolecho.co.uk/news/liverpool-news/jaguar-land-rover-issues-crisis-32447659
Khleedril
@GossiTheDog It will be funny if cars start rolling off the production lines with manufactured dents in them.
Alex
@GossiTheDog is this why uk keeps getting pwned by kids?
Kevin Beaumont
JLR shouldn't feel bad, Tata Motors (their parent) is way worse shape. They've even got Exchange Server with OWA internet facing without MFA.
Kevin Beaumont
JLR have started switching border routers back on (don't ask me why SNMP, NTP and SSH are internet facing).
Alex
@GossiTheDog I was making a joke... xD
lfzz
@GossiTheDog @alex02 wait do you mean the overstaffed audit team is actually useless checkbox generator while I can't even get a junior hired because "security team are expensive" and we should be able to automate/ai/buzzworddujours our work away? I am very shocked!
Kevin Beaumont
Jaguar Land Rover have told factory workers worldwide to stay home until at least next Wednesday, which will be 17 days since the cyber incident began. https://www.bbc.co.uk/news/articles/c3e712nvyz9o.amp
Kevin Beaumont
Unite are calling on the government to urgently intervene over the Jaguar Land Rover cyber incident, to introduce a furlough scheme for their suppliers.
Gary :party_porg:
@GossiTheDog as a tax payer, but also a union member: screw that.
JLR should have insurance to cover this.
Just_Patch_It
@GossiTheDog Have they not heard of Disaster Recovery? It’s also called “Business Continuity Plan” just in case I’m not clear.
Greem (Graeme. Not Graham!)
It isn't JLR that's affected here though (although they are, and friends of mine who work for them are currently having nightmares) - it's their suppliers. By that argument, they should also have insurance.
I guess tying a small company's entire output to one upstream behemoth used to be a safe bet, but not now.
Kevin Beaumont
JLR have lost between £50m-£100m so far according to BBC estimates https://www.bbc.co.uk/news/articles/czdjn0lv64ro
Kevin Beaumont
If anybody is interested, TCS’ website says JLR outsourced cybersecurity (not sure which bits) to it a few years ago.
TCS also run security operations and monitoring for Co-op (my old team) along with their IT and IT helpdesk, and M&S secops monitoring, IT and IT helpdesk.
VessOnSecurity
@GossiTheDog I wonder how big the ransom was...
Mark :unverified: :thisisfine:
I don’t get it..
BBC news article,
“However, the company made a pre-tax profit of £2.5bn in the year to the end of March, which implies it has the financial muscle to weather a crisis that lasts weeks rather than months.”
But they call for Gov for furlough…
Sleeper_cell_spy
@GossiTheDog well isn’t that interesting
Just_Patch_It
@GossiTheDog Their cars are 💩anyway. You have to buy two so you can drive one while the other is in the shop.
Kevin Beaumont
Jaguar Land Rover have extended their manufacturing shutdown until at least next Wednesday, the 24th of September. https://www.theguardian.com/business/2025/sep/16/jaguar-land-rover-production-shutdown-cyber-attack
Kevin Beaumont
In my own story, I discovered JLR outsourced different cybersecurity areas to TCS and then made many of the UK team redundant 6 months ago.
fuzzyfuzzyfungus
@GossiTheDog Risk mitigation is a cost center. For a while.
Kevin Beaumont
The BBC report just over 100k jobs sit outside Jaguar Land Rover in the supply chain, those staff are being told to apply for universal credit and the shut down could last until November. https://www.bbc.co.uk/news/articles/c784nwvj1l3o
Kevin Beaumont
Liam Byrne MP, the chair of the Commons business and trade committee has said "We think this is an attack which is much, much worse than the attack that took down Marks and Spencer."
He's calling for the government to insure suppliers via taxpayer money when orgs get hit with ransomware.
https://www.bbc.co.uk/news/articles/cwyrqxj3eqqo
Kevin Beaumont
This is JLR's parent company, and this is JLR's network border today - personally, I think there's no way the government should have the obligation to bail out this situation.
JLR just made their most profits in a decade, after making cybersecurity staff redundant in March.
Kevin Beaumont
JLR isn't on the stock market, but their parent company, Tata Motors, is. Their share price has gone up consistently since the cyber incident began.
The share price of one of JLR's key suppliers, however, has plunged 55% since the incident began.
fuzzyfuzzyfungus
@GossiTheDog But if you treat your suppliers like hostages who you are powerless to save Liam Byrne MP will show up with a sack of other people's money for free...
Kevin Beaumont
Jaguar Land Rover’s Slovak plant has been brought to a standstill for a third consecutive week after a cyberattack, sending shockwaves through the carmaker’s local supply chain and raising calls for state support for suppliers from the Slovakian government.
The factory is actually owned by Tata Motors, JLR’s parent company. Tata Motors haven’t actually disclosed it, but they too are impacted.
Kevin Beaumont
Webasto, who supply glass roofs to Jaguar Land Rover and employ 350 staff, has today halted factory operations and started laying off staff.
https://www.telegraph.co.uk/business/2025/09/18/jaguar-land-rover-supplier-puts-jobs-at-risk-cyber-hack/
Kevin Beaumont
31 British MPs have written to UK government asking for government support for JLR’s suppliers.
Kevin Beaumont
I should loop this into the thread as it may well be relevant later: https://www.bbc.co.uk/news/articles/c62z8k14kxxo
Although it only mentions TfL, they're also implicated in M&S and a metric ton of other breaches.
Including potentially JLR -- the LAPSUS$ guys were trying to start their own home brew ransomware at the time but weren't very good at it.
Kevin Beaumont
Regarding this earlier toot about JLR, you can see gaydon is one of their subdomains and sites - it's also visible on their DNS resolvers, which are back online and internet facing for some reason (gbgay) along with FortiGate firewall interfaces which are also internet facing for some reason.
The Liquid Schwartz
No mention of the attackers identity @GossiTheDog seems likely this was a state actor, but not necessarily. What's the scuttlebut?
Kevin Beaumont
Joint statement on government-industry supplier meeting regarding Jaguar Land Rover cyber incident https://www.gov.uk/government/news/joint-statement-on-government-industry-supplier-meeting-regarding-jaguar-land-rover-cyber-incident
Kevin Beaumont
Jason Richards, Unite's regional officer for the West Midlands, has said he believes that there was "zero chance" of production starting next week, after suppliers were told production at JLR's factories would not resume until 24 September. So far JLR have missed each potential production resume date. https://www.bbc.co.uk/news/articles/c36kjx8w793o
Khleedril
@GossiTheDog
``This allowed us to listen to suppliers directly and understand the challenges and concerns they are facing.''
... and?
Kevin Beaumont
The Guardian have a look inside the crisis at Jaguar Land Rover.
There's no new information, other than sources at the company saying they don't realistically know when they will be able to restart production.
https://www.theguardian.com/business/2025/sep/20/jaguar-land-rover-hack-factories-cybersecurity-jlr
Kevin Beaumont
One awkward element to all of this is the UK Prime Minister launched his growth strategy, with the banner Securing Our Future, at Jaguar Land Rover.
It was supposed to be how AI and automation would secure the UK economy.
fuzzyfuzzyfungus
@GossiTheDog It's really too bad that Forbes is not speaking literally; but, as ever, by the time smug elite failure runs up against someone who doesn't care even slightly whether it's technically legal, because that's orthogonal to how they operate, a large number of innocent bystanders have been dragged in.
If it were possible for the criminals to prey directly on the board we'd likely be in a whole different world of governance.
Khleedril
@GossiTheDog Because the government aren't actually providing any support?
Steve
@GossiTheDog At this point I'm questioning if JLR are ever going to return to production
Khleedril
@GossiTheDog Ah, I see I misunderstood your question, I thought you were asking, 'Why are JLR taking the lead?' not, 'Why is the JLR lead not working?'
Kevin Beaumont
Jaguar Land Rover have no cyber insurance https://www.theinsurer.com/cyber-risk/news/exclusive-jaguar-land-rover-failed-to-secure-cyber-insurance-deal-ahead-of-2025-09-23/
Gary :party_porg:
@GossiTheDog big oof!
nandezzz
@GossiTheDog I don’t understand how that’s even possible.. I mean.. I know how it’s possible - you just don’t buy the insurance but I don’t understand how JLR could have a CTO/CIO who thought that was a sensible play! There’s only two of us at my business.. even we have cyberinsurance..
TheTomas
@GossiTheDog *sigh* insurances dont contribute to your BCM. Ja maybe they'll pay later, maybe not..
Alameals
I'm Liverpool based so have neighbours and friends who work there and they are still seeing this as just some time off, I don't think they realise this genuinely could lead to job cuts across all roles, it's going to impact them financially for a long time
pmelon
Yeah, our place is uninsurable. We have some servers that are nearly 20 years old and the network is totally flat. Execs like bandwagons too much to do anything about it.
Kevin Beaumont
Peter Kyle and Chris McDonald met JLR’s CEO and senior executives at its Gaydon headquarters to discuss latest situation.
https://www.gov.uk/government/news/ministers-meet-jlr-bosses-and-supply-chain-companies-to-help-secure-future-of-car-industry
Kevin Beaumont
Robert Peston, who was the first to report on the government's bailout of banks in the 2008 financial crisis, reports the UK government is considering bailing out JLR's suppliers by effectively becoming the lender of last resort - by buying parts off suppliers, and then reselling them to Jaguar Land Rover. In effect the UK government will become JLR's supplier's customer.
https://www.itv.com/news/2025-09-24/how-the-government-plans-to-support-jaguar-land-rover-suppliers
Kevin Beaumont
If anybody is wondering, I took a tour of JLR's network border last night - everything is still offline, except for https://wslx.jlrext.com/ (single factor login), some routers running SSH to the internet, NTP and Fortigate firewalls with open ports to internet.
Kevin Beaumont
The BBC reports “Senior government figures are concerned about a pattern of cyber attacks on UK institutions and businesses, such as the British Library, Marks & Spencer, and the Co-op.”
They should be. We’ve got to collectively work together to defuse the ransomware economy - even if that means repositioning security industry incentives.
We’ve also got to be deeply honest about where the challenges are coming from - which is not just Russia, but at home in the UK.
Kevin Beaumont
The FT has figured out JLR have no insurance.
I'm not sure they'll take the full cost of recovery though - since the government is likely bailing out their key suppliers.
https://www.ft.com/content/c301e78a-38e7-4818-b367-14af85130c61
Kevin Beaumont
For those who haven't been following JLR in detail, key chain of events:
1) JLR outsource key IT and infosec functions to TCS, approved by 1x director and 2x NEDs on both JLR and TCS boards
2) JLR transfer staff by TUPE to TCS
3) TCS lay off transferred UK staff, including cyber risk and governance and cyber monitoring
4) record profits for a decade
5) got hacked
6) company stops functioning
7) get government to bail out their key suppliers (in progress)
Kevin Beaumont
JLR have some of its IT systems back online. Production is still halted. https://www.bbc.com/news/articles/c0q75q4l87no
I can’t see anything internet facing back online. Looks like they have bits of SAP back for supplier payment of historic orders.
Kevin Beaumont
If you’re wondering how JLR’s parent company, Tata Motors, is getting on - share price is up over the month. Investors don’t really care that a large part of the org shut down as they know the UK taxpayer will prop it up.
Dr. Christopher Kunz
@GossiTheDog And then there's this, too. Shareholders don't give a damn if your products take down whole airports.
Kevin Beaumont
The Chair of the Business and Trade Committee, Liam Byrne, has today written to TCS asking probing questions about the attacks on Co-op, Marks and Spencer and Jaguar Land Rover. https://committees.parliament.uk/publications/49627/documents/264574/default/
Dave 🐶
@GossiTheDog And everyone was worried about Huawei providing services to CNI...
Kevin Beaumont
Personally I think the UK is going to be one to watch now, as if I was an e-crime threat actor - I’d zero in on the UK.
Orgs have shown they will pay, teens getting in and poor MSPs shows poor security practices, the NCA won’t tell the ICO (data regulator) too around what actually happened, and the government will bail out orgs financially and provide IR help while they recover.
It’s all of the wrong messages being broadcast. Strap in.
Kevin Beaumont
If you look at the NCSC UK too, their remit is to help make the UK the safest place to do business..
but if you look at the general output lately, it’s quantum stuff and firewall espionage stuff. They’re good people but it feels too close to GCHQ, and so too far removed from the operational reality on the ground.
Ollie Whitehouse
@GossiTheDog we have also recently released (last week) a buyers guide for external attack surface management - https://www.ncsc.gov.uk/blog-post/easm-buyers-guide-now-available - d
we also continue to push forward on Share & Defend too etc.
all of which are intended to protect the many and reduce the easy wins.
Ollie Whitehouse
@GossiTheDog which is the intent of Share & Defend - to protect those who can't protect themselves.
it's a fair challenge - we are also working on some upstream stuff like passkeys etc.
Ollie Whitehouse
@GossiTheDog we refer to this as 'Market Incentives'
https://www.ncsc.gov.uk/collection/ncsc-annual-review-2024/chapter-03/market-incentives
https://www.ncsc.gov.uk/blog-post/market-incentive-the-pursuit-for-resilient-software-hardware
https://www.ncsc.gov.uk/blog-post/sausages-incentives-rewarding-resilient-technology-future
.. we are on it, but will need a little time ..
Stevǝ :mastodon: :blinkingcursor:
@GossiTheDog we’re in for some chop for sure..
We’ve gone from 3 lines of defence and skills-based hiring to “let the cheapest bidder run our identity service and we’ll cross our fingers that they really do background checks and basic awareness training”
Also, cyber resilience?
We’re seeing teenagers directly skew the UK economy…
Nice work NCSC etc …
When you don’t really know who manages your stuff, grants access to your stuff, backs your stuff up or protects your stuff… you’ve outsourced responsibility whilst remaining entirely accountable
The threat actor ecosystem is largely driven by financial reward… which makes these supply chain watering holes irresistible…
Kevin Beaumont
My view - saying the recent incidents should be a wake up call isn’t moving the needle enough in business.
So a lever is, if JLR need bailing out, put the PM on TV to announce it, explain why and the context of attacks on UK institutions, and announce paying all extortion attempts will be outlawed by the end of parliament. It would send shockwaves through business and force real resiliency planning.
lambtor
@GossiTheDog surely some kind of insurance coverage could be a requirement for these organizations? they don't want to spend on their own infrastructure, they can pay higher premiums.
Kevin Beaumont
The Times (paywalled) reports JLR plan to restart some production in just over a week - "puts suppliers on notice for production at its Wolverhampton engine works to resume on October 6"
Kevin Beaumont
Government to guarantee £1.5bn loan to Jaguar Land Rover directly https://www.bbc.com/news/articles/cgl15ykerlro
Kevin Beaumont
There’s a bit on TCS outsourcing of key roles at JLR here. https://www.telegraph.co.uk/business/2025/09/26/suspected-weak-link-in-jaguar-land-rover-ms-hacks/
Kevin Beaumont
Jaguar Land Rover has sought £2 billion in emergency funding from global banks as the carmaker tries to ease the financial strain of cyber incident.
The funding is separate from a £1.5 billion loan, provided by a commercial bank and guaranteed by UK Export Finance, that the carmaker will repay over five years.
Kevin Beaumont
MPs are now saying Jaguar Land Rover may need more government invention on top of the existing £1.5bn help https://www.bbc.com/news/articles/c62zggj69e0o
Schroedingers_Cat
@GossiTheDog SUrely the invisible hand of the market will handle this?
craignicol
@GossiTheDog @anilmc don't TCS and JLR have the same parent? Certainly can't be helping TCS reputation. Don't they have a few UK public sector contracts too?
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.