Blog

A group of English-speaking hackers linked to the Marks & Spencer cyber-attack has claimed responsibility for an attack on Jaguar Land Rover.

A channel on the Telegram platform posted a screenshot of what appeared to be the car maker’s internal IT systems, as well as a news article detailing the hack.

The name of the Telegram channel is a combination of three English language speaking, or western-based, hacking groups known as Scattered Spider, Lapsus$ and ShinyHunters.

Scattered Spider, a collective of teenage and twentysomething hackers, has been blamed for attacks this year on British retailers M&S, Co-op and Harrods. Four people including three teenagers were arrested at UK addresses in July as part of an investigation into the retail cyber-attacks.

Britain’s biggest car maker halted production at key sites on Monday after admitting its manufacturing and retailing activities had been “severely disrupted” by a cyber incident. It said there was no evidence that any customer data had been taken but had “proactively” shut down its systems and taken “immediate action to mitigate” the impact.

JLR did not give more details about who was behind the cyber incident, when it was discovered or how long it would take to recover from it.

Car industry sources said the incident had severely affected its suppliers, which normally make regular deliveries of parts to its factories. These suppliers could lose tens of millions of pounds in sales because of the halt in production, they added.

Aiden Sinnott, a security researcher at UK cybersecurity firm, said one of the personas on the Telegram group, Rey, shared the same name as a member of Hellcat, the ransomware gang that claimed to have extracted data from JLR earlier this year. Sinnott said Hellcat fitted the same mould as Scattered Spider and ShinyHunters.

“They speak English and they are keen on using social media channels,” he said, adding that Lapsus$ shared similar tactics and demographics as the Scattered Spider collective.

The cyber-attack at JLR comes amid disruption from the impact of US tariffs and declining sales.

The car maker reported that underlying pre-tax profits fell by 49% to £351m in the three months to June, which included a period when the company temporarily paused exports to the US.

In 2023 an 18-year-old from Oxford and part of the Lapsus$ hacking group, Arion Kurtaj, who is autistic, was sentenced to an indefinite hospital order after stealing 90 clips of the unreleased Grand Theft Auto 6 game as part of a hacking spree.

Describing ShinyHunters and Scattered Spider, Sinnott said: “Consolidating them into a group is difficult because they are essentially individuals operating online, communicating via platforms like Telegram, who might sometimes work together.”

Sinnott said Scattered Spider was an “umbrella term for a kind of demographic” of hackers in their late teens or early 20s who are native English speaking and “don’t really fit into a box as a structure hierarchy”. Traditionally, groups that deploy ransomware – malicious software that locks up a target’s IT systems – are linked to eastern Europe and former Soviet Union countries including Russia.

The ShinyHunters group also has French links. Sebastien Raoult, a Frenchman in his early 20s, was sentenced to three years in prison in the US last year for his activities as a ShinyHunters member.

The Telegraph first reported the activity on the Scattered Lapsus$ Hunters group.

A spokesperson for the National Crime Agency said: “We are aware of an incident impacting Jaguar Land Rover and are working with partners to better understand its impact.”

The car maker, which is headquartered in Coventry, employs 32,800 people in the UK across 17 different sites.

JLR has been contacted for comment.

As the stablecoin market continues to evolve at lightning speed, regulation of these innovative financial products has strived to keep apace. While the GENIUS Act in the United States has created a robust regulatory framework, there remains fragmentation due to the regulatory approaches taken by different states. However, several recent federal legislative actions provide some clarity and predictability to this rapidly changing space—but it is still unclear how successful these efforts will be.

A key feature of the GENIUS Act is its approach to harmonizing federal and state stablecoin[1] regulatory frameworks, particularly through the establishment of the Stablecoin Certification Review Committee (SCRC), which will be chaired by the secretary of the US Department of the Treasury and include the chair of the Federal Reserve and chair of the Federal Deposit Insurance Corporation.[2]

In sum, the GENIUS Act provides a regulatory framework for payment stablecoins in the United States and provides for the SCRC to be responsible for determining whether a particular state’s stablecoin regulatory framework is “substantially similar” to the required federal framework.

Accordingly, the SCRC will wield considerable influence over state-level stablecoin regulatory regimes and in doing so will seek to provide private stablecoin issuers with consistent standards designed to prevent fraud and ensure consumer protection throughout the US market. However, with state-issued stablecoins exempt, questions remain as to the extent to which the GENIUS Act can successfully create regulatory consistency.[3]

FEDERAL AND STATE REGULATORY DIVIDE

The GENIUS Act delineates a clear federal framework for the regulation of private payment stablecoins while also allowing states to promulgate their own state-level private payment stablecoin regulatory regimes.[4]

Under the GENIUS Act, state-qualified payment stablecoin issuers with a consolidated total outstanding issuance of not more than $10 billion may elect to be regulated under a state-level regime provided that the state stablecoin regime is substantially similar to the federal framework.[5] This provision aims to streamline the regulatory landscape for privately issued stablecoins and reduce the complexity of navigating disparate state regulations.

The SCRC will play a deciding role in this process by determining whether state regulatory frameworks are “substantially similar” to the federal regime. SCRC decisions to approve state stablecoin regulatory frameworks must be unanimous,[6] which effectively ensures that each state’s regulation of privately issued stablecoins will align closely with federal standards, promoting consistency across jurisdictions and preventing states from creating a stablecoin regulatory framework that is either too stringent or too permissive.

Nevertheless, the SCRC’s role will be limited to the oversight of a state’s regulation of privately issued stablecoins and will not extend to state-issued stablecoins themselves.

STABLECOIN CERTIFICATION REVIEW COMMITTEE

The SCRC will be responsible for reviewing and certifying state regulatory regimes to ensure they meet the standards set forth in the GENIUS Act. This process will involve an initial certification by state regulators, to be submitted to the SCRC by July 18, 2026, which will then be followed by a review and potential recertification by the SCRC.[7] The SCRC’s role will extend beyond the initial certification and involve ongoing oversight and the ability to deny or revoke a certification if a state’s stablecoin regulatory regime fails to maintain required standards.[8]

This oversight function will be crucial in maintaining the integrity and safety of the stablecoin overall market in the United States, effectively ensuring that all private stablecoin issuers operate under similar regulatory frameworks. While each state’s regulatory regime for privately issued stablecoins must be substantially similar to the federal standards, the SCRC’s authority does not extend to state-issued stablecoins, which are not covered by the GENIUS Act.

STATE GOVERNMENT–ISSUED STABLECOINS

The exemption from the GENIUS Act for state-issued stablecoins has not gone unnoticed by several states. Wyoming has emerged as an early mover in the state-issued stablecoin arena, launching the Frontier Stable Token (FRNT) on August 20, which is backed by US dollars and short-term Treasuries. Since 2016, Wyoming has passed more than 45 pieces of crypto-linked legislation, and the state’s special purpose depository institution banking charter further provides a framework for custody services and other crypto-related products.

The rapid launch of the FRNT after the passage of the GENIUS Act is part of Wyoming’s push to attract digital asset businesses and promote digital asset innovation in the state. Its neighbor to the east, Nebraska, has also obtained legislative approval for a state-issued stablecoin and will likely follow in Wyoming’s footsteps. More states are expected to follow.

NEXT STEPS TO EXPECT

The present parallel systems between state-issued stablecoins and privately issued stablecoins present both opportunities and challenges for private stablecoin issuers, particularly as more states explore the potential of state-issued stablecoins. Federalism disputes could arise as regulators seek to balance federally mandated consistency for private issuers with a state’s ability to launch and operate stablecoins under its own standards, without federal preemption or approval.

The federal government is left with only indirect levers, such as Financial Stability Oversight Council designations, if a state’s stablecoin scheme threatened the monetary system or violated federal law. Accordingly, stakeholders should remain engaged with regulatory developments to ensure compliance and capitalize on opportunities presented by an evolving landscape.