A cyber-attack that severely disrupted Jaguar Land Rover’s operations last year was state-sponsored, a former defence minister has confirmed. Al Carns made the acknowledgment in July, a month after resigning from his government position, during an event at the Chatham House international affairs think tank.

The attack, which occurred in August, is estimated to have cost the automotive company up to £2.1 billion, making it one of the most costly cyber incidents in the United Kingdom’s history. Production at Jaguar Land Rover was halted, affecting approximately 200,000 jobs, and the company was unable to fully resume operations for almost five weeks.

The cyber-attack did not only impact Jaguar Land Rover directly but also disrupted about 5,000 related organizations, including affiliated showrooms, repair shops, and numerous small manufacturers involved in supplying parts and materials. While reports at the time suggested that Russia was a likely perpetrator, no definitive public attribution had been made prior to Mr. Carns’ remarks.

During the Chatham House event, when asked about national resilience to such threats in the absence of political leadership, Carns emphasized that the government possesses extensive information and intelligence on cyber threats, espionage, and ongoing conflicts, such as those in Ukraine. He lamented the lack of a unified public discussion, stating that despite knowing the details of incidents like the Jaguar Land Rover hack, there is no coherent national dialogue between government and society addressing these risks.

In response to the former minister’s statements, David Reed, a shadow defence minister, called for greater transparency from the government, arguing that the British public deserves to be informed about the origins of a cyberattack with such severe financial consequences. Reed described it as “scandalous” that the government would withhold information on who was responsible for what is considered one of the country’s most damaging cyber incidents.

Jaguar Land Rover was contacted for comment but had not issued a response at the time of reporting.