FAC FEATURE

Jaguar Land Rover (JLR), one of Britain's most prominent automotive brands, was hit by a major cyber incident that began around Sunday, August 31, 2025, and was officially confirmed shortly thereafter. In response to the intrusion, JLR took immediate action by proactively shutting down its global IT systems to mitigate the impact. This necessary step led to the "severe disruption" of the company's vehicle production and retail activities worldwide, forcing staff at UK plants, including Halewood, to be told not to report to work. The attack proved particularly damaging as it coincided with the crucial UK "New Plate Day" on September 1st, preventing dealers from registering or delivering new vehicles and highlighting the vulnerability of advanced manufacturing, where the integration of IT and operational technology (OT) systems can create a single point of catastrophic failure.

September 26, 2025


Jaguar Land Rover (JLR), one of Britain’s flagship automotive brands, has been grappling with the aftermath of a severe cyber attack that has crippled its operations for nearly a month. The incident, which began around Sunday, August 31, 2025, forced the luxury carmaker to take the drastic measure of proactively shutting down its global systems to mitigate the impact.


While JLR's response has been noted for its decisiveness, the attack has exposed critical vulnerabilities inherent in advanced manufacturing, particularly the complex web of interconnected IT, operational technology (OT), and delicate supply chains.


The Devastating Results and Financial Fallout


The immediate result of the cyber incident was the severe disruption of JLR's retail and production activities globally. Staff at plants, including Halewood in Merseyside, were told not to report to work, leading to halted production lines. The timing of the attack—coinciding with the crucial “New Plate Day” on September 1st—added insult to injury, preventing dealers from registering or delivering new vehicles and resulting in immediate revenue losses.


The extended shutdown, which was originally anticipated to last weeks, has had significant financial implications:


  • Massive Financial Losses: The disruption is estimated to be costing JLR as much as £50 million per week in lost production. The total cost is expected to run into the hundreds of millions of pounds.
  • Data Compromise: Although JLR initially stated there was no evidence of customer data theft, the company later confirmed on September 10th that "some data" had been affected, and regulators were notified.
  • Insurance Exposure: JLR may be facing the full financial burden of the attack, as reports suggest the company failed to finalize cyber insurance cover before the incident occurred.


Advanced Manufacturing: A Single Point of Failure


The JLR attack underscores the systemic cyber risk facing advanced manufacturing sectors. JLR’s commitment to "smart factories where everything is connected" ultimately created a single point of failure.


The severe disruption highlights the deep interconnection between IT (Information Technology) systems and OT (Operational Technology) systems that run the assembly lines. Experts note that automotive companies are increasingly vulnerable due to this merging of IT and OT zones. When the attack was discovered, JLR was unable to isolate individual factories or functions, forcing it to shut down most of its systems entirely as a precaution against the spread of the intrusion or potential physical damage.


Furthermore, the structure of JLR’s cybersecurity management has been scrutinised. The company outsourced large portions of its IT, networks, data connections, and crucially, its cybersecurity operations to Tata Consultancy Services (TCS) under a five-year, £800 million contract in 2023. This outsourcing arrangement is now at the centre of the response and recovery effort.


The Cyber Crisis Ripples: Supply Chain Implications


The most severe implication of the prolonged shutdown has been the turmoil across JLR’s complex, sprawling supply chain. The supply chain supports an estimated 100,000 to 200,000 jobs in the UK.


Issues Surrounding Supply Chain Security and Financial Strain:


  1. "Just-in-Time" Fragility: The "just-in-time" nature of automotive production meant that many suppliers had no choice but to halt production immediately after JLR’s announcement.
  2. Liquidity Crisis: Suppliers, particularly smaller, Tier-two and Tier-three firms, are operating on thin margins. Many had not been paid since late August. This cashflow drought has left some suppliers with only "seven to 10 days of cash left," putting their future viability at risk.
  3. Government Intervention: The potential collapse of suppliers, which could further hold up JLR’s ability to restart production, prompted government discussion about intervention. Ideas considered included the government buying component parts from suppliers to ensure their cashflow.
  4. Financial Resolution: Ultimately, the government moved to guarantee a £1.5 billion loan to JLR through the Export Development Guarantee (EDG). This measure is intended to help JLR support its supply chain and protect skilled jobs in the region. JLR is now working to clear the backlog of payments to suppliers as quickly as possible, having brought its invoicing system back online as part of its phased restart.


Identifying the Threat Actors


A hacker group calling itself Scattered Lapsus$ Hunters claimed responsibility for the cyber incident. This name suggests a collaboration between three well-known English-speaking cyber gangs: Scattered Spider, Lapsus$, and ShinyHunters. The group gained notoriety earlier in 2025 for high-profile attacks on UK retailers, including Marks and Spencer, the Co-op, and Harrods.


The incident also follows an earlier breach in 2025 involving the HELLCAT ransomware group, which compromised JLR systems using stolen Atlassian Jira credentials harvested by malware, leaking hundreds of internal documents and employee data. The sophistication and organisation of the perpetrators suggest this attack was carried out by a professional network of savvy actors.


In conclusion, while JLR has begun a phased restart of operations—including payments to suppliers and the registration of new vehicles—the full recovery of complex, digital infrastructure remains a significant and time-consuming challenge. The incident serves as a serious "wake-up call to British industry," highlighting that cyber resilience must be treated as a core element of industrial and financial infrastructure, not merely an IT side-issue.he UK's aerospace and defence landscape, has recently undergone a significant transformation, making it a key facility that members of the Farnborough Aerospace Consortium (FAC) should be familiar with. Positioned adjacent to Farnborough Airport and recognised as the borough’s largest employment area, CTP is cementing its status as a centre of excellence for aerospace, defence, and technology businesses.



Critical Lessons and Cybersecurity Resolutions


The JLR cyber crisis offers crucial lessons for all large enterprises, particularly those in manufacturing with complex, integrated supply chains:



Issue Critical Lesson Learned & Resolution
Interconnected Systems (IT/OT) Segmentation and Manual Fallbacks: Since IT outages can stall production lines, companies must design systems to continue core functions even during an attack. Segmentation (creating digital firewalls between production networks and general business IT) is crucial to contain the attack radius. Maintain manual fallbacks for critical operations
Incident Response Speed Act Quickly and Decisively: JLR's quick decision to isolate systems likely limited the damage. Organisations must pre-authorize who can isolate systems (at the board level) and rehearse these actions regularly. The controlled, phased restart approach minimises the risk of reinfection
Identity and Access Management Harden Access Controls: Attackers often exploit weak links like legacy test accounts or stolen credentials (e.g., Jira credentials harvested by malware in the HELLCAT attack). Companies must strengthen controls, enforce Multi-Factor Authentication (MFA), and preferably roll out phishing-resistant logins, such as FIDO2 keys, for all users
Supply Chain & Third-Party Risk Audit External Providers: Given that third-party vendors and outsourced services can be the entry point, third-party assessments and audits are essential to secure the weakest link in the cyber security chain. Securing data flows between systems and supply chains is critical
Crisis Preparedness Practice Joint IT–OT Tabletop Exercises: Comprehensive cyber tabletop exercises must be conducted, bringing together IT, OT, executive leadership, PR, and legal departments to simulate scenarios and ensure coordination during a crisis
Information Security Posture Adopt Zero Trust: Moving towards a Zero Trust model—where no user, device, or system is trusted by default—is a necessary long-term undertaking, especially for established businesses with older, integrated systems

Sources Cited

  • Abnormal AI Data provider cited for analysis suggesting a seasonal pattern in retail-focused cyberattacks.
  • Acumen Cyber Cybersecurity firm; comments provided by Nathan Webb, principal consultant.
  • APTS Threat actor who appeared on DarkForums on March 14, 2025, and leaked an additional tranche of JLR data (estimated 350 GB) following the HELLCAT breach.
  • BBC (British Broadcasting Corporation) Cited for reporting that the JLR attack began on Sunday, 31 August; providing factory idle cost estimates (around £50 million per week); reporting claims made by the 'Scattered Lapsus$ Hunters' group; noting that government intervention (buying parts) would be a first time following a cyber-attack; and reporting on the Unite union's response to the government loan.
  • BreachForums (.hn domain) Platform where the ShinyHunters collective posted legitimate updates after their Telegram account was banned.
  • Brose German seat controls manufacturer cited as a company whose workers were affected by the shutdown.
  • Chambers of Commerce (Greater Birmingham, Black Country and Coventry & Warwickshire) Conducted a survey of 84 companies in the West Midlands regarding the negative impact of the cyber-attack.
  • Clorox (US manufacturer) Cited as a US manufacturer that suffered a breach in August 2023 linked to a compromise by its third-party IT service provider.
  • Competition and Markets Authority (CMA) Mentioned regarding the need for further enforcement to prevent vendor lock-in.
  • CreditSights Bond rating agency; Jim Williamson estimated JLR’s potential cash burn and decline in working capital.
  • CYFIRMA Provided comprehensive analysis regarding the technical exploit perspective of the cyber incident.
  • Dana Axel maker cited as a company whose workers were affected by the shutdown.
  • Department for Business and Trade (DBT) British government department that issued a statement acknowledging the significant impact on JLR and the wider supply chain.
  • DVLA (Driver and Vehicle Licensing Agency) JLR was registering new vehicles via telephone to them during the outage.
  • EclecticIQ Cybersecurity firm; comments provided by CEO Cody Barrow regarding the timing of the attack.
  • ESET Cybersecurity firm; Jake Moore (Global Cybersecurity Advisor) commented on the simplistic approach of the attack and the brazen confidence of hacking groups; ESET also provided data on consumer caution regarding online shopping post-breach.
  • The Financial Times Source for a report claiming JLR was in talks with broker Lockton about cyber insurance.
  • Forbes Cited for discussing Tata's organizational structure and technical mismanagement.
  • The Guardian Reported on managers at the Halewood factory noticing a possible hack; also cited Anupam Singhal, TCS president of manufacturing, discussing "smart factories".
  • Harrods High-profile UK retailer cited as a victim of cyber attacks earlier in 2025.
  • HELLCAT ransomware group Ransomware group that claimed responsibility for a major data breach against JLR earlier in 2025, leaking hundreds of internal documents and compromising employee data via stolen Jira credentials.
  • Huntress Cybersecurity firm; comments provided by Dray Agha (Senior manager of security operations) on manufacturing vulnerability and advice on segmentation.
  • The Hindu Business Line Suggested that JLR began resuming systems, primarily offline, towards the end of September 3, 2025.
  • The Insurer Industry journal citing three insurance sector sources regarding JLR failing to finalise cyber insurance cover.
  • ITV News Reported on the government idea of using taxpayer money to purchase parts to support the supply chain.
  • Lear Corporation Seat maker cited as a company whose workers were affected by the shutdown.
  • Liverpool Echo Reported that JLR workers at the Halewood plant were told by email not to come into work; also reported on September 4 that JLR staff were still not back at the Merseyside factory.
  • Lockton Insurance broker reportedly involved in JLR's cyber insurance discussions.
  • LAPSUS$ Known English-speaking hacker collective mentioned as part of the 'Scattered Lapsus$ Hunters' name.
  • Marks and Spencer (M&S) High-profile UK retailer cited as a victim of cyber attacks earlier in 2025; TCS was also involved in providing IT services to M&S.
  • Microsoft (Midnight Blizzard attackers) Russian state-backed attackers cited in analysis of how a legacy system can give attackers access to critical systems.
  • National Crime Agency (NCA) UK law enforcement agency that stepped up investigations into ransomware groups; arrested four individuals (aged 17–20) in connection with the earlier retail hacks.
  • National Cyber Security Centre (NCSC) UK government cyber experts working with JLR to provide support.
  • National Technology Source for the timeline confirming disruption began on Sunday, August 31, 2025.
  • NetSPI Cybersecurity firm; comments provided by Sam Kirkman (director of services, EMEA).
  • Opswat Cyber security platform supplier; comments provided by James Neilson (senior vice-president of international).
  • Reuters Reported in May that Tata Consultancy Services (TCS) was the "means of access" for hackers to get into M&S’s systems.
  • SAP (German company) Software provider whose systems (specifically SAP Netweaver) were vital to managing JLR's production; a known flaw in this software may have been exploited.
  • Scattered Lapsus$ Hunters Hacker group claiming responsibility for the JLR cyber incident (September 2025 attack).
  • Scattered Spider Known English-speaking cyber gang mentioned as part of the 'Scattered Lapsus$ Hunters' name.
  • Scottish government/Alexander Dennis Cited by the Unite union general secretary Sharon Graham as having set up a support scheme for the bus maker that could be used as a model for JLR suppliers.
  • ShinyHunters Known English-speaking hacker collective mentioned as part of the 'Scattered Lapsus$ Hunters' name; previously linked to high-profile attacks on UK retailers.
  • Sky News Cited The Insurer in their report regarding JLR failing to secure cyber insurance.
  • Society of Motor Manufacturers & Traders (SMMT) Issued a joint statement with the Department of Trade and Industry acknowledging the scale of the disruption and meeting with suppliers.
  • Sunday Times Reported speculation that operations at JLR would be disrupted for "most of September" or worse.
  • Tata Consultancy Services (TCS) India-based IT company to which JLR outsourced a huge part of its computer systems and cybersecurity under a £800 million contract in 2023; TCS was also asked by MPs to share findings from investigations into attacks on M&S and Co-op.
  • Tata Motors India-based company that owns Jaguar Land Rover (JLR).
  • The Telegraph Cited a supplier warning about the integrated UK automotive system.
  • The Com Loose online criminal network associated with Scattered Spider and ShinyHunters.
  • Unite union Union that represents JLR employees and supply chain workers, calling for a furlough scheme to support wages during the shutdown.
  • US’s Cybersecurity and Infrastructure Security Agency (CISA) Reported to have warned about the SAP Netweaver flaw that may have been exploited in the JLR attack.
  • Webasto Sunroof maker cited as a company whose workers were affected by the shutdown.