UK explores Kremlin link as carmaker restarts production after global shutdown.
The British government is now investigating whether Russia was behind a cyber attack that forced Jaguar Land Rover (JLR) to halt production across its global manufacturing network for more than a month.
Officials familiar with the inquiry confirmed that the possibility of Kremlin involvement remains “an active line of enquiry,” although no final determination has yet been made.
The large-scale breach, detected on August 31, shut down JLR’s plants in the UK, Brazil, Slovakia, and India, disrupting the company’s 800 internal computer systems and putting around 200,000 jobs at risk throughout its supply chain.
The attack’s scale and the absence of any ransom demand have led investigators to consider whether it was the work of a hostile state rather than criminal hackers.
Teams from the Government Communications Headquarters (GCHQ) and the National Cyber Security Centre (NCSC) were deployed to JLR to assist in restoring operations and to trace the source of the intrusion. The National Crime Agency is also supporting the investigation.
A government spokesperson said:
“The investigation is ongoing, and we would caution against speculation. The Government has persistently called out a range of actors for malicious cyber activities against the UK and will continue to do so.”
The disruption to JLR prompted the Treasury to underwrite a £1.5 billion loan guarantee, amid concerns that smaller suppliers dependent on the company could face severe financial strain. Business Secretary Peter Kyle previously warned that the hack risked “serious consequences” for those firms.
Chancellor Rachel Reeves last month identified Russia as being behind “a number of these attacks,” though she did not refer to specific incidents.
“We also need to deal with this at source,” Ms Reeves said. “It’s coming from hostile states, states like Russia – and that’s why we are doing what we are doing.”
Defence officials have also expressed concern over a potential Russian link. Shadow Defence Secretary James Cartlidge said:
“In a context where Putin has been provoking Nato allies with drone and fighter jet incursions, if this turns out to be a Russian cyber attack on our industry, that would be very significant indeed.
We know Russia is deliberately testing our resolve. It underlines why all the effort in Government needs to be on the defence of the homeland.”
The incident follows a series of cyber attacks on major UK retailers and service providers, including Marks & Spencer, the Co-op, and Harrods.
Meanwhile, operations at JLR’s Range Rover factory in Solihull resumed last week as the company continues to recover from what officials have described as one of the most serious cyber attacks ever to hit a British manufacturer.
