Consultation

Case study · Manufacturing

Jaguar Land Rover: weeks of idle factories and a state-backed loan

UK, 2025. A cyberattack stops production for weeks and reaches over 5,000 organisations across the supply chain.

In one sentenceA cyberattack on one manufacturer is an outage for thousands of suppliers: the government had to guarantee a £1.5bn loan.

Sector
Automotive manufacturing
Country
United Kingdom
Date
Confirmed on 2 September 2025
Duration
Production stopped for weeks, restarted in stages from early October 2025
Estimated cost
£1.9bn to the UK economy (range £1.6–2.1bn), according to the Cyber Monitoring Centre

Analysis based solely on public information. FZ Consultation was not involved in this incident and has no affiliation with the organizations named.

What happened

  1. 2 September 2025

    JLR confirms a cyber incident, says it took immediate action to mitigate the impact, and states that its retail and production activities are “severely disrupted”.

  2. Following weeks

    Assembly is suspended at Solihull and Halewood; the Wolverhampton engine plant is affected; dealers cannot process new orders (according to trade press).

  3. In the weeks that follow

    The UK government announces a £1.5bn loan to JLR, largely guaranteed by UK Export Finance.

  4. Early October 2025

    Production restarts gradually.

  5. Late October 2025

    The Cyber Monitoring Centre estimates the cost at £1.9bn and rates the event Category 3, calling it the most economically damaging cyber event to hit the UK.

What went wrong

According to the public sources listed below.

A production line that could not run without its systems

According to reports, containment meant switching off core systems, and the plants could not run without them for weeks. A degraded mode, if one existed, was not enough.

An outage that becomes the whole chain's outage

The CMC counts over 5,000 UK organisations affected, from suppliers to transport and retail. The government had to guarantee a £1.5bn loan to the company.

Credentials as the way in (a claim)

The Scattered Lapsus$ Hunters group claimed it used stolen Atlassian Jira credentials, obtained through malware and phishing. This claim comes from the attackers and is not confirmed by JLR.

Lessons for your organization

  1. 1

    Know what production cannot run without

    List the systems the line cannot run without and decide in advance whether they can be isolated without stopping the plant.

    Know: measure what stopping would cost
  2. 2

    Rehearse a staged restart

    Set the order in which systems return and who authorizes it, then try it before the incident.

    Prove: rehearse before the real day
  3. 3

    Protect credentials to internal tools

    Multi-factor authentication and access reviews on engineering and project tools, not just on email.

    Prepare: recovery that holds

Check on Monday morning

Three questions to put to your own organization this week. If you cannot answer one of them in five minutes, that is your first task.

  1. Which systems can your production not run without, and could you isolate them without stopping the plant?
  2. Have you prepared a staged restart: what comes back first, second, and who authorizes it?
  3. How many weeks could your key suppliers last if you stopped ordering? Do you know, or are you assuming?
Put a number on a multi-week production stop

Sources

More case studies