Scattered Lapsus$ Hunters — actor profile

Actor profile· ACT-008

Files naming the group

Sectors in the corpus

Jurisdictions

2025

Earliest file

Campaign timeline10 files

JUL 2026Qantas26-0702Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.JUN 2026Multiple organisations26-0625A name concatenated from three crews. Attribution language implies a roster, and a coalition brand quietly breaks that implication.OCT 2025Jaguar Land Rover25-1008A stopped production system does not resume — it restarts from a different state. Nobody publishes the recovery curve.OCT 2025Jaguar Land Rover25-1004cBreach registers count individuals. Cost surveys estimate dollars. Nothing counts jobs.OCT 2025Unnamed JLR supplier25-1001bForty people at one supplier is the number that describes what the £1.9 billion is made of.SEP 2025JLR small suppliers25-0930bResilience is a wasting asset in cash as well as in process, and nobody tracks the financial half.SEP 2025JLR supply chain25-0929bNo records exposed, no notification owed, nothing in any register. What happened is that people stopped being paid.SEP 2025Jaguar Land Rover supply chain25-0928An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.SEP 2025Ransomware ecosystem25-0905The average operation is getting weaker and the worst one is getting stronger. The aggregate statistics cannot show it.SEP 2025Jaguar Land Rover25-0902No affected-individual count anchors this file. A manufacturer could not manufacture for five weeks, and the metrics this industry collects barely register it.

Attribution note

This desk carries the name because the operation uses it, not because three groups are established to have merged. Where a file can only support one component, it names that component instead. The composite is a self-description and is recorded as one.

MITRE ATT&CK

G1015 · Scattered SpiderThe “Scattered” component G1004 · LAPSUS$The “Lapsus$” component G1057 · ShinyHuntersThe “Hunters” component

Three ATT&CK groups, nine vendor aliases, one name. Nothing else in this corpus makes the case for a naming registry as plainly: without the identifiers, the relationship between this dossier and the files at 22-0120, 22-0808 and 22-0322 is invisible.

Sectors targeted

Manufacturing7

Multiple2

Retail1

All 10 files in the database →

Defender notes

• Treat the composite name as a claim about lineage, not about personnel.

• Expect extortion without encryption — the corpus records no reliable encryption step here.

• Check whether a file names the composite or one component; they are different claims.

ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreaches Ransomware Nation-state Cloud

DataCase files Data export Actor index Glossary Methodology

ContactSecure tips Corrections The desk Ethics