Seamless Recovery
Manufacturingransomware5 min read

JLR’s Supply Chain Disruption

Downtime Duration

2-3 months

Estimated Costs

£200 million + a £1.5 Billion Government Loan

Records Exposed

Approx~ 1 Billion

Operational Impact

  • Sales & new vehicle deliveries halted
  • Car manufacturing plants grounded to a halt
  • Economy, both local and nationwide, affected

Summary

Jaguar Land rover (JLR) plays an important role in the UK's economy. One Ransomware attack is all it takes to grind everything to a near halt.

Full Analysis

Introduction

On August 31st, several car manufacturing plants owned by Jaguar Land Rover (JLR) were hit by a cyber-attack that crippled their car registration and delivery systems (Dailymail.com, 2025). This has forced JLR to cease production throughout September 2025, leading to devastating effects on their business and their supply chains. This only goes to show how a single cyber-attack can lead to a domino effect that impacts thousands of people.  

Entry Vector 

Reports (BBC.com, 2025C) have confirmed that a group of young teens that are associated with the hacker group Scattered Spider may have been behind the hack. According to an inside source, the hackers bragged about the hack on telegram channels under the group name, Scattered Lapsus$ Hunters, representing the merger of several hacker groups behind prominent hacks in recent years, such as the attacks on M&S, Co-op and Harrods earlier this year. It has been the only information on how the hack was conducted or when did JLR discover their systems were compromised so far (Theguardian.com, 2025C).  

Impact   

Financial 

JLR’s financials have taken a serious toll as they were left with no secure way to pay their suppliers. This has forced them to apply for a £1.5bn loan from the UK Government to stabilise themselves and their 700 suppliers, which JLR are expected to pay off over the next 5 years (BBC.com, 2025A). Whilst many suppliers and local MPs have welcomed the loan as crucial business support, it has also led to concerns over how JLR will pay off this tremendous debt, with some fearing that corner cutting is to be expected. Some banks even asked local JLR suppliers to put their homes and other valuable assets up as personal guarantees to access emergency funds. Lobby groups have criticised this, saying the UK government needs to focus on doing more or local businesses rather than supporting JLR, and that the whole UK automobile production industry is at risk of collapse if they do not act now (TheGuardian.com, 2025B). 

Overall, JLR have estimated that the cyber-attack has cost them £200m, with revenues plummeting by a far more staggering £1bn for the business quarter starting from to September (Birmingham Post, 2025A) 

Supply Chain 

Many local MPs have complained about the lack of a quick response and the thousands of jobs across areas like the black country put at risk (BBC.com, 2025A). Many suppliers were at the point of risking bankruptcy until the resumption of JLR’s car production in October put them back in business (BBC.com, 2025B). It has been estimated that the effects of the cyber-attack will continue to haunt JLR suppliers and their credit for the next 6 months (BBC.com, 2025C). 

On September 30th, JLR hosted a virtual meeting with several of its suppliers throughout the West Midlands to discuss the impact the cyber-attack had on their supply chain. During the meetings, several points where raised; 

  • JLR were expected the resolve the issue on their own, from re-instating their systems to paying off suppliers to prevent a financial knock-on effect for local suppliers 
  • JLR were criticised for a lack of communication, created an ‘every man for himself’ mentality    
  • Some aluminium plants closed due to cancelled orders 
  • Local businesses have been affected by the hack as many if their clients now buy from Chinese suppliers. The hack seems to have exacerbated this.  
  • Discussions on how to effectively spend the £1.5bn government loan, as supplier Insolvency is a major issue     
  • It would take an estimated 4 weeks to 1 month of downtime before things were turned around, with the government loan expected to solve the problem quickly – according to the combined authority.      
  • Engine plants expected to start reopening from the 7th of October onwards. 

Production and the Economy 

The Wolverhampton facility was among the first to be reopened to production around the start of October 2025 (Theguadian.com, 2025A). Whilst it would take a while for the plant to resume full production, it’s reopening is still welcomed by local communities for the cash flow it will reintroduce as the Wolverhampton factory plays a major role in local economics, whether it’s the number of factory employees or local businesses that rely on JLR for business (BBC.com, 2025E).  

The cyber-attack has proven to have a domino effect on local economies and, very prominently, on JLR’s manufacturing and production. In October alone, car production fell by 27.4% as many JLR factories were shut down briefly, with locations in the West Midlands and Halewood on Merseyside being closed until early October (news.sky.com, 2025B)   

At the start of November, it was reported that JLR had restarted their manufacturing in mid-October, including sites at Solihull and Halewood. Despite boosting UK manufacturing production, it will prove to be a temporary spike in the economy, according to Rob Dobson, director at S&P Global Market Intelligence (itv.com, 2025).  

Recent reports have suggested more far-reaching effects, as the entire UK economy’s growth has been affected by the cyber-attack, shrinking by 0.1% unlike when it was predicted to grow by 0.1% (Birmingham Post, 2025B). This is because JLR’s forced shutdowns have led to a 28.6% collapse in UK car production. Whilst there are over factors involved such as decreased UK output production and a decrease in car producers, the attack on JLR has still affected overall Gross Domestic Product (GDP) numbers, which is alarming (news.sky.com, 2025C). 

Duration 

The hack was brief, but its effects were drawn out; the main car plants affected where shut down for over a month through September and into October as some plants, like one branch based on Wolverhampton were expected to resume limited production (BBC.com, 2025B). 

The Seamless Solution 

Due to a lack of knowledge on how JLR’s systems got infected initially, it’s hard to make an accurate judgement call on how they could have prevented this. Considering that the same hacker group behind the M&S attacks have claimed responsibility, it’s therefore safe to assume that JLR had similar issues with their own attack.   

  • Upon the virus being discovered, the systems and computers infected by the ransomware must be quarantined and isolated from any essential systems to prevent further damage and encryption. 
  • A full back up of essential systems, especially concerning manufacturing and supply chains to suppliers, must be kept in case the ransomware spreads. This backup must be kept updated regularly and heavily protected. 

Conclusion 

The cyber-attack on Jaguar Land Rover only represents recent years and unfortunate trend in recent years. In this case, its consequences were much more devastating on both a local and country wide scale. It only goes to show the damage a small group of hackers can cause to a business without the proper and seamless cybersecurity in place. 

Sources 

  • BBC.com (2025C): JLR cyber attack impact ‘may last for six months’: https://www.bbc.co.uk/news/articles/c0qpl0v3gnzo 
  • BBC.com (2025D): M&S hackers claim to be behind Jaguar Land Rover cyber attack: https://www.bbc.co.uk/news/articles/c4gqepe5355o  
  • BBC.com (2025E): JLR shutdown weighs heavy on local economy: https://www.bbc.co.uk/news/articles/crkjv4m78v3o 
  • (Birmingham Post, 2025A): Cyber-attack cost car giant nearly £200m. News article Published by Birmingham Post, November 20th 2025. 
  • (Birmingham Post, 2025B): Call for Action as economic growth falls to 0.1%. News article Published by Birmingham Post, November 20th 2025 
  • Itv.com (2025): Manufacturing production increases after JLR factory restart following cyber attack: https://www.itv.com/news/central/2025-11-03/manufacturing-production-up-after-jlr-factory-restart-following-cyber-attack 
  • news.sky.com (2025C): Budget 2025: The extraordinary impact of a crime on UK growth that Reeves could do without: https://news.sky.com/story/budget-2025-the-extraordinary-impact-of-a-crime-on-uk-growth-that-reeves-could-do-without-13469485 
  • Theguardian.com (2025C): Hackers linked to M&S breach claim responsibility for Jaguar Land Rover cyber-attack: https://www.theguardian.com/business/2025/sep/03/hacking-group-linked-to-marks-and-spencer-cyber-attack-claim-responsibility-for-jaguar-land-rover-hack 
← Back to Incident Library

See the Recovery Orchestration Engine in action.

Tour the solution story built for investors and acquirers.

No lock-inIntegrates with your existing stackEnterprise ready