The event
This week, The Telegraph reported that a former UK defence minister had said the 2025 attack on Jaguar Land Rover was state-sponsored, with losses of up to £2.1 billion (Business Insurance). He made the remark at a Chatham House event in July. It surfaced only now, and he said it was not based on an official Ministry of Defence assessment (UNN).
The attack struck at the end of August 2025. It halted production for five weeks and hit around 5,000 businesses (LBC). The government has still not named anyone, citing an ongoing investigation.
What everyone is saying
The debate is about who did it. Was it a criminal crew, or a state hiding behind one? Each new report is treated as a step closer to the truth.
The contrarian read
Wrong question. The forensics are not what is missing. What is missing is a decision.
Follow how the attribution has travelled.
- From late August 2025Production stops for five weeks. The National Crime Agency later links the attack to Scattered Spider, a criminal group.
- June 2026The New York Times, citing people close to the investigation, reports it was Russian in origin. The former minister says Russian hackers shut down Britain’s biggest carmaker.
- July 2026At a Chatham House event, he calls it state-sponsored, adding that this is not based on an official assessment.
- October 2026His remark reaches the press. The government has still named no one.
Each step came through a less accountable channel. None came from the government.
That is how states signal without committing. Naming a state creates an expectation of response: sanctions, retaliation, a diplomatic cost. Leaks, former officials and anonymous sources let the message land while every option stays open. In June, the former minister also said there was no ransom demand (LBC). If that holds, this was a capability test, not a robbery.
There is a commercial edge too. Since March 2023, Lloyd’s has required standalone cyber policies to exclude losses from state-backed attacks that significantly impair a state’s ability to function or its security. Policies must also set out how attribution to a state will be agreed (Insurance Journal). The market’s model clauses rely on the affected state’s government to determine attribution (Pillsbury via JD Supra). Whether or not this case reaches that threshold, the principle stands: a government’s silence can shape who pays.
The geopolitical frame
If a G7 state with a mature attribution apparatus stays silent for fourteen months on its most expensive cyber incident, smaller states will face the same calculation with fewer tools.
Attribution capability is sovereignty. So is the discipline to decide when to use it.
For governments, for boards
For governments
Write your attribution doctrine before the incident: who names, on what evidence, and what follows. Improvising it under public pressure hands the timing to your adversary.
For boards
The legal category of your next incident may be decided by a politician, not by your forensic team. Know what that would mean for your cover.
Monday morning
- Read your exclusions. Ask your broker how your cyber policy treats a state-backed attack, and who decides attribution.
- Map your blast radius. This outage reached about 5,000 businesses. Know which suppliers would stop you, and which customers you would stop.
- Rehearse five weeks without IT. Test whether your critical operations can run on manual fallback for longer than a weekend.
About the desk
Elias Marek is the pen name of Beyond’s threat-analysis desk: practitioners with two decades across offensive security, government, finance and critical infrastructure. The Contrarian Desk is opinion. Where it names a state, it says who named it first.
All columns