Overview

• The automaker confirmed it proactively shut down IT systems to contain the incident and said there is currently no evidence customer data was stolen.
• Production at the Halewood plant paused with staff told not to report, and dealers were unable to register new '75' plate vehicles.
• A Telegram channel linked to Scattered Spider, ShinyHunters and Lapsus$ shared screenshots purporting to show internal access, with a user known as “Rey” tied to the claim.
• The BBC reported a purported group spokesperson said they were trying to extort JLR, while reports of data theft, ransomware or the full scope remain unverified.
• JLR says systems are coming back online in stages with external specialists involved, and the UK National Crime Agency said it is aware and working to assess the impact.