Jaguar Land Rover (JLR) has now admitted that some data may have been stolen in a recent cyber-attack that interrupted its car production.

Initially, the firm said that they had no evidence the hack affected customer data. However, 11 days after JLR went public with the attack, the firm confirmed that some data has been “affected” as a result of the attack.

“As a result of our ongoing investigation, we now believe that some data has been affected and we are informing the relevant regulators,” the firm said in a statement. “Our forensic investigation continues at pace and we will contact anyone as appropriate if we find that their data has been impacted.”

The initial attack severely disrupted the car production operations of the firm – the soonest these are projected to restart is on Thursday, whereas Sky News reported that the soonest return to work would be September 15. Production at some of its factories were immediately disrupted, and staff were even sent home in English facilities in Solihill, Halewood, and Wolverhampton.

A group has already claimed responsibility for the attack, though this has not bee confirmed. Scattered Lapsus$ Hunters, an amalgamation of three separate ransomware gangs, took credit for the hack.

Recommended reading

• Jaguar Land Rover Cyber-attack Disrupting Production and Sales
• M&S Hackers Take Credit for Jaguar Land Rover Cyber-attack
• How Scattered Spider’s Web Brought UK Retail to its Knees

The ransomware group is thought to consist of young, mainly native English speakers. Its an amalgamation of former members of notorious ransomware groups Shiny Hunters, Lapsus$, and Scattered Spider, that emerged from The Com.

While JLR continues to work with third-party cyber organisations, and has notified Information Commissioner’s Office of the impacted data, it remains to be seen how devasting the attack will be, and if customer data was compromised.