Tata-owned Jaguar Land Rover (JLR) fell victim to a major cyber-attack aat the end of August. It significantly disrupted the OEM’s IT systems, halting its global production and retail operations through September and into October..
The cyber-attack incident saw prolonged factory shutdowns leading to automotive supply chain disturbance, financial losses and fears surrounding job security. The attack is still under investigation, with some data confirmed to have been compromised.
Cubic³, a company who specialise in delivering secure, cloud-based solutions to companies, has published research which shows that 49% of drivers worry their vehicles could be hacked. If OEMs can’t safeguard their own infrastructure, it’s only a matter of time before drivers will begin to question the security of their cars and associated personal data.
We spoke to Dave Kelly, Chief Corporate Officer, Cubic³, to learn more about how OEMs can better defend customers against cyber-attacks, and if giving drivers control over their data is the way forward.
Just Auto (JA): Why does JLR’s cyber-attack pose a real threat to consumer trust in connected cars and OEMs’ ability to protect personal data?
Dave Kelly (DK): The JLR incident proves just how fragile trust in connected mobility can be. While this attack targeted infrastructure and suppliers, the reality is that vehicles themselves could easily become the next potential target. A zero-day exploit on a vehicle system could leave fleets stranded, forcing OEMs to scramble for patches – delays that risk both customer safety and brand reputation.
Beyond individual exploits, a distributed denial-of-service (DDoS) daisy chain spreading from vehicle to vehicle could see drivers and the OEM temporarily locked out. Our research reveals that nearly half of drivers fear their car could be hacked. For consumers, the concern isn’t just safe driving but also data, identity, and mobility security. OEMs’ inability to protect these can erode confidence in connected vehicles, risking reputational damage and slowing adoption without proactive security.
How should OEMs act to ensure safety?
OEMs must recognise that connectivity – while a driver of innovation – could also significantly broaden the attack surface and is a threat vector. First and foremost, OEMs need to be very conscious of security when selecting their connectivity partners. An experienced partner, with automotive focus, will have the right solutions in place to limit the threat vector, such as closed-user group and dedicated tunnels or VPNs.
In addition, to reducing the connectivity as a threat vectors, vehicles are now increasingly defined by software, raising the stakes even higher. Building resilience requires integrating cybersecurity into the software development lifecycle: threat modelling, secure coding, vulnerability scanning, code reviews, and penetration testing must be standard procedures. Compliance frameworks like AUTOSAR help ensure longevity.
Connectivity allows automakers to deploy AI-driven threat analysis, continuous monitoring, and automated scanning from the cloud – essential as vehicle software grows more complex. Over-the-air (OTA) updates also enable automakers to patch vulnerabilities at scale with minimal disruption, while strong encryption and strict access controls protect both vehicle and customer data. However, to achieve this, OEMs must now treat cybersecurity as a fundamental design principle.
Connectivity can also be used a weapon in the armour of the OEMs to stop DDOS attacks from spreading. Connectivity management platforms, such as Cubic, are adding features allowing their OEM partners to quarantine impacted vehicles or models to avoid further proliferation of the attack.
How can automakers deliver SDV experiences while still meeting global compliance standards and safeguarding sensitive customer data?
Global standards like ISO 26262, GDPR, CCPA and emerging data privacy laws must be hardwired into automakers’ operations. Connectivity is the enabler here: it supports secure data handling, real-time consent management, and compliant cross-border transfers .
Strong encryption protects data in transit and at rest, while secure cloud infrastructure centralises sensitive information under layers of protection – multifactor authentication, role-based access controls, and continuous monitoring. Secure OTA updates ensure vulnerabilities are patched rapidly, reducing exposure to breaches without disruptive recalls. Just as important is supplier security: connectivity allows OEMs to exchange Software Bills of Materials (SBOMs) and continuously assess third-party components, ensuring the entire ecosystem upholds customer data standards.
Why is giving drivers control over what data is collected and how it’s used so important?
For many consumers, connected features raise questions: What data is being collected? Who has access? How is it used? It means that automakers have had to become increasingly transparent to maintain customer confidence. By applying the principle of data minimisation – only collecting essential information, anonymising where possible, and always offering opt-in/opt-out controls – OEMs can achieve that level of trust. Connectivity enables this at scale: through infotainment systems and mobile apps, drivers can instantly view, adjust, or revoke permissions.
This accessibility empowers customers and reassures them that privacy isn’t an afterthought. When consumers feel in control, they are more willing to adopt advanced connected services, from personalised infotainment to predictive maintenance. Without transparency, consumer uptake risks stalling.
What do you see the future holding for issues such as this?
The JLR incident has shown that cybersecurity will be a defining factor for the automotive industry’s future. As vehicles evolve into fully software-defined platforms, cyber-attacks will become more sophisticated, leveraging AI, automation, and zero-day vulnerabilities. OEMs will need to move from reactive to predictive security, using AI-driven analytics and digital twins to anticipate threats before they materialise. Global regulations will tighten, requiring greater transparency in data use, supplier security, and patching timelines.
The Software Bill of Materials (SBOM) will likely become standard practice, ensuring visibility into every component in the supply chain.
Consumers, meanwhile, will increasingly expect transparency and control over their data, viewing privacy as integral to safety.
