Hellcat claimed in March 2025 that it had stolen tens of gigabytes of data from Ascom and Jaguar Land Rover. Ascom confirmed that its technical ticketing system had been compromised, but the available disclosures did not establish ransomware encryption or validate Hellcat’s claimed data volume. Jaguar Land Rover did not contemporaneously confirm the March allegation.
What Hellcat claimed
On March 21, 2025, SecurityWeek reported that the Hellcat ransomware group—also styled “HellCat” in some coverage—claimed to have attacked Ascom and Jaguar Land Rover.
As an Amazon Associate I earn from qualifying purchases.
The group allegedly claimed that it had stolen tens of gigabytes of data from each organization. That figure remains an attacker-attributed allegation, not an independently measured or company-confirmed loss. The available material also does not establish that both organizations had their systems encrypted, received a ransom demand, or experienced a conventional ransomware deployment.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The reviewed reporting does not provide independently validated samples, screenshots, filenames, or other technical evidence sufficient to prove the full claims. A post on a leak site or an attacker’s statement can indicate a possible compromise, but it is not, by itself, proof of access, exfiltration, or attribution.
What Ascom confirmed
Ascom said a cyberattack on March 16, 2025, compromised its technical ticketing system. In a March 17 statement, the company said it immediately shut down that system and began investigating, with authorities involved.
Ascom also said that its other IT systems and customer systems were unaffected and that normal business operations continued. It said customers and partners did not need to take preventive action at that time.
That is a meaningful confirmation of compromise, but it does not confirm every part of Hellcat’s account. Ascom did not publicly verify the alleged theft of tens of gigabytes or identify the categories and quantity of data allegedly taken in the statement reviewed.
Was Ascom’s incident definitely ransomware?
Not on the available evidence. Ascom described the event as a cyberattack and acknowledged Hellcat’s claim that it was responsible. The company statement did not say that ransomware had encrypted systems, that a ransom demand had been received, or that ransomware had executed across Ascom’s network.
The most precise description is that Ascom confirmed a cyberattack and compromise of its technical ticketing system, while the alleged ransomware activity and data theft remained unverified.
What was known about Jaguar Land Rover
The March 2025 Jaguar Land Rover allegation remained a Hellcat claim in the reviewed material. No contemporaneous JLR disclosure located for this account confirmed that Hellcat breached the automaker or stole the claimed amount of data.
That distinction matters because JLR later disclosed a separate cyber incident in September 2025. In a September 10 statement, JLR said its investigation indicated that “some data” had been affected and that it was notifying relevant regulators. JLR worked with outside cybersecurity specialists, and its later incident affected global applications and business operations, according to JLR’s incident information.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallJLR did not attribute that later incident to Hellcat in the official statement cited here. Contemporary reporting said the company had not identified a specific cybercrime group. A separate group calling itself Scattered Lapsus$ Hunters later claimed responsibility and alleged that ransomware had been deployed, but that claim was not an official JLR attribution.
The March Hellcat allegation should not be treated as a description or confirmation of the September JLR incident. The reviewed sources do not establish that the two events were connected.
The possible Jira connection
Contemporaneous reporting associated Hellcat’s activity with Jira servers and ticketing environments targeted using compromised credentials. BleepingComputer described the group as targeting Jira servers worldwide in a campaign involving compromised credentials and noted Ascom’s confirmation of an IT attack.
That reporting may explain why Ascom’s ticketing system appeared in the group’s claims. It does not, however, prove the specific entry point used against Ascom or Jaguar Land Rover. The available disclosures do not establish phishing, multifactor-authentication bypass, exploitation of a particular Jira vulnerability, or credential theft for either victim.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Nor does the appearance of both companies in Hellcat-related reporting prove that they were compromised in one coordinated operation. A shared alleged target type could reflect a broader campaign, but demonstrating a common operation would require evidence such as matching infrastructure, reused credentials, identical tooling, the same initial-access broker, or a direct statement linking the intrusions.
Best Value
- SonicWall Gateway Anti-Malware, Intrusion Prevention & Application Control for NSA3600 - 1 Year License (01-SSC-4435)
- Real-Time Malware Scanning: Block viruses, spyware, and ransomware at the gateway before they reach endpoints or servers.
- Intrusion Prevention System (IPS): Detect and stop network-based attacks, exploits, and denial-of-service attempts using constantly updated threat signatures.
- Application Intelligence & Control: Identify, monitor, and restrict the use of applications to enforce policies and reduce bandwidth abuse.
- Low-Latency Deep Packet Inspection: Analyze traffic without slowing performance, using SonicWall's patented Reassembly-Free DPI engine.
How to read ransomware-group claims
Ransomware groups commonly use public claims to pressure victims, attract attention, or create leverage. Readers should separate four different questions:
- Was there unauthorized access? A victim’s confirmation of compromise is stronger evidence than an attacker’s post alone.
- Was data copied or stolen? This requires evidence of exfiltration or validated samples; system access does not automatically prove that data was taken.
- Was ransomware deployed? Encryption, operational disruption, or a documented ransom demand would support that description. A group’s branding does not establish it.
- Who was responsible? Attribution requires more than a leak-site label, particularly when groups, affiliates, and impersonators can overlap.
Closing a ticketing system can be a containment measure rather than evidence that an entire corporate network was encrypted. Likewise, a company may confirm a compromise while withholding details about data exposure until its investigation is complete. A later regulatory notification confirms that an organization treated an incident as reportable; it does not validate every earlier attacker claim.
Confirmed facts versus allegations
| Organization | Confirmed information | Unverified or attributed claim |
|---|---|---|
| Ascom | Its technical ticketing system was compromised on March 16, 2025, then shut down. Ascom said other IT and customer systems were unaffected and operations continued. | Hellcat’s alleged theft of tens of gigabytes, any specific stolen files, and ransomware deployment. |
| Jaguar Land Rover | No contemporaneous confirmation was located for Hellcat’s March claim. JLR later confirmed a separate September 2025 incident in which some data was affected. | Hellcat’s alleged March breach, the claimed data volume, and any alleged ransomware deployment. |
Timeline
- March 16, 2025: Ascom said its technical ticketing system was compromised.
- March 17, 2025: Ascom publicly acknowledged the attack, closed the ticketing system, and said other IT and customer systems were unaffected.
- March 20, 2025: BleepingComputer reported on Hellcat’s Jira-related activity and Ascom’s confirmation.
- March 21, 2025: SecurityWeek reported Hellcat’s claims involving Ascom and Jaguar Land Rover, including the alleged tens-of-gigabytes data theft.
- September 2025: Jaguar Land Rover disclosed a later cyber incident and said some data had been affected. The cited official statement did not attribute it to Hellcat.
Why the wording matters
Calling this “Hellcat’s attacks on both companies” overstates what was established. The defensible account is narrower: Hellcat claimed data theft from Ascom and Jaguar Land Rover; Ascom confirmed a compromise of its technical ticketing system; and the available material did not independently confirm the alleged data volume, ransomware encryption, or a March Hellcat breach of JLR.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
