04.09.2025
2 min
597
A group of young English-speaking hackers called Scattered Lapsus Hunters, formed from the merger of Scattered Spider, LAPSUS and Shiny Hunters, has claimed responsibility for the attack that paralyzed Jaguar Land Rover production lines worldwide on August 31. The attackers are posting images on Telegram, allegedly taken from inside the company’s networks, mocking the brand, hinting at possible blackmail attempts.
Jaguar Land Rover confirmed major disruptions and forced system shutdowns that brought its Solihull and Halewood plants to a standstill. While the company says there is no evidence of customer data being compromised, internal instructions and logs published by the hackers indicate unauthorized access. The group has been actively using a Telegram channel with over 50,000 followers to hype up the situation and threaten new victims, including Vodafone UK and government agencies. According to experts, despite the spectacular nature, the main goal of such attacks is to gain control over sensitive data for further blackmail or sale on the darknet.
Scattered Lapsus Hunters emerged after a series of high-profile attacks on British retailers Marks & Spencer, Co-op and Harrods, as well as after large-scale campaigns against Salesforce integrations that affected Palo Alto Networks, Cloudflare, Zscaler and other companies. Earlier, the UK National Crime Agency had already detained several teenage suspects, but their activities did not stop. The group’s Telegram channels are regularly closed, but new ones appear quickly.
The Jaguar Land Rover case shows that the combination of production sabotage and public blackmail is becoming a new trend among cybercriminals. For companies, this means the need for increased segmentation of internal networks, operational response on weekends and multi-level monitoring of data access. At the same time, regulators must respond more quickly to the rise of “youthful” cartels that combine aggressive communication with real-world hacking.
