JLR cyber attack 'state-sponsored', says former minister: what it means for small businesses

The cyber attack on Jaguar Land Rover (JLR) in late summer 2025 is back in the news. On Sunday the Telegraph reported that Al Carns, a former defence minister, has said the attack was state-sponsored. It's the first time a government figure has said so publicly.

For most small businesses, who was behind it is less important than what it did, and what you can learn from it. So here's a short summary and a few practical points.

What has been said?

Speaking at a Chatham House event in July, Mr Carns said: "We know the Jaguar Land Rover attack was state-sponsored". He has since told the Telegraph that this was not based on an official Ministry of Defence assessment. His view is that an attack on that scale would be very unlikely to happen without the host country knowing about it.

He didn't name a country. In June the New York Times reported, citing people familiar with the investigation, that a group of Russian hackers was responsible. The government says it does not comment on ongoing investigations, and no official assessment has been published. The opposition has called for answers.

At the time, a group calling itself Scattered Lapsus$ Hunters claimed responsibility. Whether that group was acting alone, with tacit approval or under direction is the question still being argued about.

A quick reminder of the impact

The attack started on 31 August 2025. JLR shut its systems down, production stopped, and it took around five weeks to get going again. The Cyber Monitoring Centre estimates the cost to the UK economy at between £1.6bn and £2.1bn, which makes it the most expensive cyber attack in British history.

The part that matters most for SMEs is where that damage landed. Around 5,000 other organisations were affected, including suppliers, dealerships and repair shops. Many were small businesses that had done nothing wrong themselves. Their customer simply stopped ordering, and their invoices stopped being paid.

Does "state-sponsored" change anything for a small business?

Not really. It's a fair question, though, because "state-sponsored" sounds like something only governments and big manufacturers need to worry about.

In practice, state-linked groups and criminal gangs often use the same methods: phishing emails, stolen passwords, fake calls to the IT help desk asking for a password reset, and unpatched systems facing the internet. The basics that stop a criminal gang make a state-backed group's job harder too. You don't need a different set of defences because of who might be on the other end.

The bigger lesson from JLR is about resilience. It isn't only about keeping attackers out, it's about how quickly you can keep trading when something goes wrong, whether that's your own systems or a customer's or supplier's.

What we'd suggest

1. Get the basics right. Multi-factor authentication on every account, especially email and admin accounts, supported and patched devices, and no one working day-to-day with admin rights. This is the core of Cyber Essentials, and it's where most attacks are stopped.
2. Decide how password resets are checked. Several of last year's big attacks reportedly involved someone talking their way past a help desk. Agree how your team, or your IT provider, confirms they're speaking to the right person before resetting a password or MFA.
3. Know that your backups will actually restore. Keep a copy that can't be changed or deleted from your normal accounts, and test a restore. A backup that has never been tested is a hope, not a plan.
4. Write down what you'd do on day one. Who you'd call, how you'd contact staff and customers if email was down, and which systems you'd need back first. One or two pages is plenty.
5. Think about your dependencies. If your biggest customer or a key supplier went offline for five weeks, what would happen to your cash flow? It's worth talking to your accountant, your insurer and your bank before you need to.
6. Check your cyber insurance. Make sure you understand what it covers, including business interruption, and what it expects you to have in place.

None of this is new, and none of it needs to be done in a panic. The JLR attack is simply a good reminder of why it's worth doing.

How we can help

If you'd like to know where your business stands, there are three easy ways to start:

1. Run a free domain scan. It takes a minute and shows how your email security looks from the outside, including whether someone could send email pretending to be you.
2. Book a free IT Health Check. A wider look at your setup, from accounts and devices to backups, with an engineer on Teams or on your own.

Book a discovery call

at a time that suits you, and we'll talk through Cyber Essentials, backups or incident planning without the jargon.

For a longer look at what last year's big attacks teach smaller businesses, see our article on what M&S, Co-op, JLR and The Farmer's Dog teach every business.

Want this handled for you? See Cyber security services.

Based in Brighton or Hove? We are too: see IT support in Brighton.