Last year, hackers attacked car giant Jaguar Land Rover (JPL), one of the U.K.’s biggest employers. The hack halted production for months and made a dent in the country’s economy. The damage was so severe that the U.K. government decided to bail out the company with a £1.5 billion (around $2 billion) payment, and estimates say the hack cost the British economy $2.5 billion. 

For months, there was only speculation about who did it. Now, citing people close to the investigation, The New York Times reports that the hackers behind the breach were Russian, although it’s still unclear if they were working directly for Vladimir Putin’s government, were just criminals, or something in between, like criminals operating with the government’s tacit approval. 

Microsoft was tracking the Russian hacking group and alerted JLR to the information about the hacker’s identities, the Times reports. However, sources also said that the FBI, Britain’s National Crime Agency and National Cyber Security Centre, Google’s Mandiant unit, and Palo Alto Networks all worked on the investigation. 

In what is a rare, but not an unprecedented occurrence in the world of cybersecurity, it turned out that the Russian hacking group was not the only one that breached some JPL networks. A Jordanian hacker who went by Rey had also broken in, according to the Times.