A cyberattack crippled Range Rover production. The reboot is proving tough.

Hundreds of high-end SUVs usually roll off Jaguar Land Rover's production lines every day. This month, they have fallen silent.

- Stephen Wilmot

A cyberattack discovered late last month prompted the Range Rover maker to power down its operations, a response that could cost the company tens of millions of dollars and threatens jobs across its supply chain.

The British company is now racing to restart its systems safely with the help of top cybersecurity experts flown in from around the globe. On Tuesday, it said the process “will take time” and extended the shutdown—previously expected to end Wednesday—to Sept. 24.

The company has also said some data was compromised, having initially said there was no evidence of stolen customer information.

JLR is working with the U.K’s National Cyber Security Centre—part of Britain's GCHQ signals-intelligence agency—to investigate the hack and with government ministers in London to minimize the ripple effects through its supply chain. The company declined to comment.

Hackers belonging to a trio of infamous cybercriminal groups—Lapsus$, Shiny Hunters and Scattered Spider—appeared to claim responsibility on a joint Telegram channel that went by the name “scattered

LAPSUS$ THE WALL STREET JOURNAL. hunters 4.0” before it was taken offline Tuesday.

“Rip bozooo #JLR,” “Full SRC codes too,” and “We backdooring all yo CARS,” the authors wrote in rapid-fire messages on Sept. 3, after sharing a screenshot that appeared to come from a carmaker's internal system. SRC is short for source, suggesting that the hackers are claiming to have JLR’s source code—a potentially serious breach.

Cyber experts say the groups, which consist largely of young men and teenagers, are capable, but the boasts they broadcast need to be treated with a high level of skepticism.