Scattered Spider-Linked Group Claims JLR Cyber-Attack – Source: www.infosecurity-magazine.com

Jaguar Land Rover (JLR) is investigating claims by a hacker syndicate linked to the Scattered Spider group that they are responsible for the hack on the car manufacturing giant.

The English-speaking cybercrime group is believed to be responsible for the cyber-attacks on UK retailers Marks & Spencer (M&S), The Co-op and Harrods earlier this year.

The BBC reported the claims following private text conversations with an individual purporting to be a spokesperson for the group, who have dubbed themselves “Scattered Lapsus$ Hunters,” suggesting a possible collaboration between Scattered Spider, ShinyHunters and Lapsus$.

The BBC said the group alleges it has accessed JLR’s systems and is trying to extort the firm for money.

It has not been confirmed whether any data has been stolen or if Scattered Lapsus$ Hunters installed ransomware.

However, the group shared screenshots reportedly taken from inside JLR’s IT networks on the messaging app Telegram. The unverified images included internal instructions for troubleshooting a car charging issue and internal computer logs.

Following a request for comment from Infosecurity regarding the claims, a JLR spokesperson wrote: “We are aware of the claims relating to the recent cyber incident and we are continuing to actively investigate.”

JLR first confirmed it had suffered a cyber incident on September 2, which it said had severely disrupted sales and productions operations after the car maker proactively shut down its systems to mitigate the incident.

Staff working at JLR’s Halewood production plant in Merseyside, UK, were told not to come to work on Tuesday, September 2, because of the disruption caused by the cyber incident.

JLR has not provided further any details on the impact on operations at the time of writing. However, local news outlet, the Liverpool Echo, reported on September 4 that JLR staff were still not back at the Merseyside factory.

Scattered Spider Courting Attention for Activities

Sam Kirkman, director of services, EMEA at NetSPI, said the group’s interaction with the BBC shows its desire to elicit attention for its activities, a tactic that it also employed following the M&S attack in April.

“The group have made concerted efforts to draw attention to their activities, suggesting that operational disruption and reputational impact are also objectives, alongside financial extortion of their target,” he noted.

“It is important to note that the screenshot could not be verified and may have been fabricated to elicit further attention for the group,” Kirkman continued.

Jake Moore, global cybersecurity advisor at ESET, noted that hacking groups like Scattered Spider are becoming increasingly bold, looking to flaunt their successes.

“By using Telegram to flaunt their claims and ransom demands, it demonstrates brazen confidence in staying undetected, only adding insult to injury,” he commented.

Apparent Cross-Group Merger a Cause for Concern

Scattered Spider’s apparent collaboration with ShinyHunters and Lapsus$ could have a significant impact on the group’s capabilities, according to Nathan Webb, principal consultant at Acumen Cyber.

All three groups are known for their use of social engineering techniques to gain entry into targets, before using tactics like extortion and data theft for financial gain.

Recently, Scattered Spider and ShinyHunters have used vishing techniques to gain high value credentials in third-party IT providers. This includes ShinyHunters reported compromise of Salesforce customer credentials, impacting firms including Google, Chanel and Adidas.

“The threat actors have clearly come together to improve the effectiveness of establishing initial access to victims, with the group collaborating on techniques and the data they have available to enhance their attacks,” Webb commented.

“The growing collaboration between threat-actor groups to execute crimes underscores how much they now operate like enterprises, and reinforces the need to harden defenses,” he added.

Like Scattered Spider, Shiny Hunters and Lapsus$ are comprised of English-speaking actors.

Scattered Spider and ShinyHunters are associated with The Com, a loosely organized online criminal network involving thousands of English-speaking individuals.

The groups are believed to include young, often teenage hackers.

In August 2023, an Oxford teenager was found to be responsible for a series of hacking incidents impacting big-name brands, as part of the infamous Lapsus$ group by a UK court.

In July 2025, UK law enforcement arrested three teenagers and one 20-year-old on suspicion of involvement in the April cyber-attacks targeting M&S, Co-op and Harrods.

Image credit: Richard OD / Shutterstock.com