Jaguar Land Rover hit by HELLCAT ransomware group
Learn More
Jaguar Land Rover (JLR) has fallen victim to the HELLCAT ransomware group. The attack has resulted in the exposure of sensitive internal documents and employee data on hacking forums, following patterns similar to previous attacks by the same group against major corporations including Telefonica, Schneider Electric, and Pinger.
Hudson Rock researchers have reported that a threat actor identified as "Rey" claimed responsibility for the breach. According to Rey's claims, approximately 700 internal JLR documents were compromised in the attack. The leaked data reportedly includes:
- Development logs
- Tracking data
- Proprietary source codes
- Employee dataset containing usernames, email addresses, display names, and time zone information
Researchers have confirmed that some of the exposed data contains information about legitimate JLR employees from global operations, raising significant concerns about potential identity theft and targeted phishing campaigns.
A second threat actor operating under the nickname "APTS" emerged on the forum with separate claims. APTS stated they had also gained access to JLR's systems using the same infostealer credentials and had stolen an even greater quantity of data. This additional data leak is estimated at approximately 350 gigabytes and reportedly contains information not included in Rey's data dump.
HELLCAT's attack against JLR appears to follow their established attack pattern of targeting Atlassian Jira instances using stolen credentials. According to Hudson Rock's cybercrime intelligence database, which contains information on over 30 million systems infected with infostealers, thousands of companies have Jira-related compromised credentials from infostealer infections.
The total number of affected individuals and the financial impact of the breach have not been disclosed.
The group likely gained initial access through compromised Jira credentials, similar to their recent attack against Telefonica where they exploited the telecommunications company's Jira platform at "jira.globalsap.telefonica.com".
Once inside a network, HELLCAT deploys a series of PowerShell scripts that establish persistence through registry modifications,
