Jaguar Land Rover cyberattack: six weeks of global production halted

2025-09-02 · Publisher : Jaguar Land Rover · Domain : Industry 4.0 & 5.0

In late August 2025, JLR shut down all its systems after a cyberattack: plants stopped for nearly six weeks, a GBP 1.5 billion state-backed guarantee, and an estimated GBP 1.9 billion cost to the UK economy, possibly the highest in its history.

What changes

  • 2 September 2025: JLR confirms it shut down its systems; production and retail severely disrupted.
  • Phased restart announced on 7 October, after nearly six weeks of shutdown.
  • 28 September: UK government guarantee (UK Export Finance) for a loan of up to GBP 1.5 billion.
  • Cost to the UK economy estimated at GBP 1.9 billion; up to 5,000 organisations affected.
  • JLR puts its direct costs at GBP 196 million for the quarter.

### Background On **2 September 2025**, Jaguar Land Rover announced it had been hit by a cyber incident and had "proactively shut down" its systems; its retail and production activities were "severely disrupted". The attack, which occurred in late August, halted all plants of the carmaker, Britain's largest automotive employer. ### Key features - **Shutdown**: nearly six weeks without production; phased restart announced on **7 October 2025**, with a scheme to pay suppliers early. Return to full production expected in January 2026, according to the Guardian. - **Public support**: on **28 September 2025**, the UK government, through UK Export Finance, granted a guarantee to unlock a commercial bank loan of up to **GBP 1.5 billion** to support the supply chain. - **Cost**: on 22 October 2025, the Cyber Monitoring Centre estimated the impact on the UK economy at **GBP 1.9 billion**, with up to 5,000 organisations affected (category 3 systemic event out of 5). JLR reported **GBP 196 million** of direct incident costs for the quarter. - **Attribution**: in June 2026, a New York Times investigation based on anonymous sources attributed the attack to Russian hackers; this is not an official attribution. ### Why it matters The JLR case shows that an attack on business IT is enough to stop entire plants: MES, logistics, supplier orders and production systems are interdependent. IT/OT segmentation, tested recovery plans and the ability to run in degraded mode become business continuity topics, not just IT security. ### Key takeaway Six weeks of shutdown and nearly GBP 2 billion in losses: cyber resilience is now a manufacturing issue.

Links

Tags : Cybersécurité OT, Automobile, Royaume-Uni, Chaîne d'approvisionnement, Résilience