12 Sep Security Breach – 12 Sep 2025
Phishing works because it exploits people, not technology. Security systems are built to block suspicious code and detect intrusions, but people are far easier to influence. Employees are conditioned to trust familiar names, respond quickly to requests from authority and act fast when something feels urgent. Attackers take advantage of these instincts, knowing that even the best defenses can be bypassed if a single person makes the wrong move. Phishing attacks often disguise themselves as legitimate emails, texts, or websites to trick users into revealing sensitive information like passwords or financial details. The best defense starts with recognising red flags—such as suspicious links, unexpected attachments, poor grammar, or urgent requests—and never clicking on unknown links or downloading unsolicited files. Organisations should train staff regularly, implement multi-factor authentication, and use email security tools that filter out malicious content.
Recent Breaches
United Kingdom – Jaguar Land Rover – Manufacturing
Exploit: Hacking
Risk to Business: Moderate: Jaguar Land Rover (JLR) has suspended production at multiple sites following a cyberattack that infiltrated its internal IT systems, with disruptions expected to last into October. Thousands of workers at JLR’s Halewood, Solihull and Wolverhampton. U.K. plants have been told to stay home until the issue is resolved, though they will continue to be paid. Similar pauses affect JLR operations in Slovakia, Brazil and India. While dealerships and garages remain open, suppliers including WHS Plastics, Evtec, OPmobility and SurTec have also been impacted. A Telegram channel linked to hacking groups Scattered Spider, Lapsus$ and ShinyHunters has posted screenshots of what appear to be JLR’s internal systems. Scattered Spider, previously tied to attacks on M&S, Co-op and Harrods, is suspected of involvement.
United States – Salesloft Drift – Technology
Exploit: Hacking
Risk to Business: Moderate: Cloudflare, Zscaler and Palo Alto Networks confirmed this week that they were affected by a hacking campaign exploiting integrations with Salesloft Drift, an AI platform connected to Salesforce systems. The campaign, attributed to threat actor UNC6395, ran between August 8 -18 and may have impacted more than 700 companies. Salesloft said attackers used stolen credentials to exfiltrate customer data via its Drift chatbot tool, acquired last year. While Salesforce disconnected Salesloft as a precaution, the company said it has seen no evidence of malicious activity within the platform itself.
Talk to a TCT team member today about implementing IT strategy plan for your business.
Robert Brown
12/09/2025
Related Articles:
Stay Safe with Encryption
Copilot in Microsoft Teams