Ransomware Attack Disrupts Jaguar Land Rover Operations as Cyber Threats Surge Across Industries Jaguar Land Rover (JLR), the UK-based automaker owned by India’s Tata Motors, confirmed a ransomware attack that severely disrupted its retail and production operations. In a statement released Tuesday, the company revealed it had taken immediate action to contain the incident by proactively shutting down systems. While JLR reported no evidence of customer data theft, it is working to restore global applications in a controlled manner. The attack is part of a broader wave of cyber incidents targeting critical industries. U.S. steelmaker Nucor also recently experienced a cybersecurity breach, forcing a shutdown of some production lines. The insurance sector has been particularly hard hit, with Aflac, Philadelphia Insurance Companies, and Erie Insurance all falling victim to attacks this summer. Grocery supply chains have not been spared United Natural Foods Inc. (UNFI), a distributor for Whole Foods and other retailers, disclosed a cyber incident in July that temporarily disrupted operations. Meanwhile, the FBI issued a warning last month about the cybercriminal group "Scattered Spider," which has been targeting airlines. Hawaiian Airlines confirmed a June cybersecurity event affecting its IT systems, while Air France and KLM reported a data breach in their customer service platform. The surge in attacks underscores the growing sophistication of threat actors and the widespread impact of ransomware on global operations.

2025: A Year of Rising Costs—and Escalating Cyber Threats for UK Businesses As 2025 draws to a close, UK businesses and charities have faced a surge in financial pressures—from soaring employment costs and supply chain disruptions to oil and tariff shocks. Yet, one of the most damaging expenses has been the fallout from cyberattacks, which have hit nearly half of British companies and 30% of charities over the past year. High-profile victims include retail giants Marks & Spencer, Adidas, and the Co-op Group, as well as Heathrow Airport, Harrods, and Jaguar Land Rover (JLR). The public sector hasn’t been spared either: Germany’s parliament and the UK Foreign Office (breached in October) were among those targeted. Attacks ranged from phishing scams to full-scale digital shutdowns, with some incidents costing hundreds of millions. The scale of cybercrime has reached staggering proportions. Cybersecurity Ventures estimates the global cost of cyberattacks in 2025 at $10.5 trillion (£7.8 trillion)—a figure that would rank cybercrime as the world’s third-largest economy, trailing only the US and China. The financial and operational toll underscores the growing threat to organizations across sectors.

Jaguar Land Rover Reports Heavy Losses Following 2023 Cyberattack Jaguar Land Rover (JLR) disclosed significant financial losses in its Q3 results, attributing much of the damage to a cyberattack late last year. Pre-tax losses reached £310 million for the quarter and £444 million year-to-date, with revenues declining 39% to £4.5 billion for Q3 and 24% to £16 billion for the year. The automaker confirmed that production disruptions from the cyber incident, alongside the phased discontinuation of legacy Jaguar models, weaker demand in China, and U.S. tariffs on exports, contributed to the downturn. However, JLR stated that operations had returned to normal by mid-November, with CEO PB Balaji emphasizing the company’s focus on recovery and long-term transformation. Despite ongoing market volatility, JLR expects a stronger Q4 performance and remains committed to its 2026 product pipeline, including the Range Rover Electric and the first new Jaguar model in years. The incident underscores the financial and operational risks cyber threats pose to major manufacturers.

The cyberattack on Jaguar Land Rover (JLR) was severe enough to halt car production across its major UK plants for over a month, marking an unprecedented disruption in the company’s history. The attack’s ripple effects extended to JLR’s entire supply chain, prompting rare government financial intervention due to its systemic economic impact. The Bank of England (BoE) explicitly cited the incident as a key factor in the UK’s slower-than-expected GDP growth (0.2% vs. projected 0.3%), estimating potential losses of £2.1 billion ($2.75 billion) to the local economy and over £2 billion in lost revenues for JLR alone. The Cyber Monitoring Centre classified it as a Category 3 systemic event, the first cyberattack in the UK to cause material economic and fiscal harm at a national level. The shutdown disrupted operations far beyond JLR, affecting suppliers and trade partners, with economists comparing its severity to crises like the global financial downturn and COVID-19—though uniquely crippling due to the complete halt in production for weeks.

Jaguar Land Rover (JLR) suffered a severe cyber attack that disrupted its operations, leading to significant financial and reputational damage. The incident, part of a broader wave of attacks targeting high-profile organizations, forced production halts, supply chain disruptions, and potential data exposure. According to the Cyber Monitoring Center (CMC), the financial impact of such attacks—including JLR’s—could reach hundreds of millions, with estimates suggesting losses comparable to those faced by retailers like Marks & Spencer (up to £440 million collectively). The attack underscored vulnerabilities in JLR’s cybersecurity culture, particularly around employee awareness and response to phishing or social engineering tactics. While the exact breach method wasn’t detailed, the operational outage and financial strain align with patterns where human error (e.g., spoofed emails, credential sharing) enabled initial access. The incident threatened JLR’s brand trust, customer confidence, and long-term market position, with recovery requiring not just technical fixes but a fundamental shift in employee behavior and risk perception.

Renault notified an unspecified number of customers that their personal data was compromised due to a cyber-attack on a third-party supplier. The breach exposed customers' first and last names, gender, phone numbers, email and postal addresses, as well as vehicle identification and registration numbers. While no financial data or passwords were stolen, the exposed information increases the risk of targeted phishing scams. The incident was isolated to the supplier’s systems, with Renault confirming its own infrastructure remained uncompromised. The third-party provider contained and removed the threat, and Renault is collaborating with them to ensure appropriate measures are taken. Authorities were notified, and customers were advised to remain vigilant against unsolicited requests for personal information. The breach follows a trend of supply chain attacks in the transport sector, highlighting vulnerabilities in vendor security.

Jaguar Land Rover Hit by Costly Cyberattack as Insurance Gap Leaves It Exposed Jaguar Land Rover (JLR), the UK’s largest automaker, is grappling with the fallout of a severe cyberattack that has forced three factories offline until at least October 1. The financial impact is estimated at £50 million ($68 million) per week, with over 30,000 employees idled and suppliers facing financial strain. The attack has been attributed to the hacking group Scattered Spider, which previously targeted British retailers, and may have exploited a vulnerability in SAP software, raising concerns about vendor governance and patch management. Unlike Marks & Spencer, which recently suffered a breach by the same group but is expected to recover over £100 million through its cyber insurance program, JLR lacks coverage. The company had been negotiating a policy through broker Lockton but failed to finalize the deal before the attack. Without insurance to offset business interruption losses, JLR is bearing the full cost of the shutdown, highlighting the risks of gaps in cyber coverage particularly for manufacturers reliant on just-in-time production and complex supply chains. The incident has sent ripples through the cyber insurance market, serving as a stress test for underwriters ahead of the autumn renewal season. It underscores the existential vulnerabilities of operating without coverage in an era of increasingly sophisticated attacks on operational technology. The shutdown has also drawn government attention, with UK industry minister Chris McDonald pledging support to stabilize JLR and its supply chain. Meanwhile, the Unite trade union has warned of potential job losses across the 104,000 roles tied to JLR’s production, and S&P Global has noted the broader economic impact in its latest UK manufacturing survey. JLR is preparing a phased restart plan, but the attack has already become a cautionary case study for enterprises on the consequences of incomplete cyber insurance placement.

Brussels Airport experienced a cyberattack on Friday evening that crippled its passenger and baggage check-in systems, forcing manual processing and causing significant operational disruptions. The attack, which also affected other European airports, targeted a third-party service provider’s systems. As of Saturday, nine flights were cancelled, and 15 departed with delays, with no immediate resolution expected. Passengers were advised to confirm flight statuses before arriving, as the outage led to processing bottlenecks and potential further cancellations. An investigation is underway to assess the full extent of the damage, but the incident has already resulted in financial losses (e.g., compensation, operational costs), reputational harm due to publicized delays, and potential long-term trust erosion among travelers and partners. The attack disrupted critical infrastructure, highlighting vulnerabilities in supply chain cybersecurity and the cascading effects of third-party breaches on large-scale operations.

Jaguar Land Rover (JLR) suffered a month-long shutdown of its factories due to a ransomware attack in August, severely disrupting its vast supply chain—including numerous small and medium-sized suppliers employing around 200,000 people. The UK government intervened with a £1.5bn loan guarantee to mitigate financial fallout, while JLR faced an estimated £200m loss in production alone. The attack occurred as the company was finalizing a cyber insurance policy (with potential premiums of £5m+ and excesses of £10m+), highlighting vulnerabilities in its cyber defenses. The incident underscored broader risks to operational continuity, financial stability, and supplier livelihoods, with layoffs already reported among affected firms. The attack also exposed gaps in data loss prevention, as cybercriminals increasingly target sensitive business data (contracts, IP, financials) for extortion, threatening long-term reputational and economic damage.

Jaguar Land Rover (JLR) suffered a severe cyberattack in September 2025, claimed by the cybercrime group Scattered Lapsus$ Hunters, which forced the shutdown of major production plants and disrupted operations for weeks. The attack resulted in £196 million ($220 million) in direct financial losses for Q2 (July–September 2025), with stolen data confirmed. The incident caused production halts, supply chain disruptions, and liquidity crises for suppliers, leading to a pre-tax loss of £485 million (vs. a £398m profit the prior year). The UK Government intervened with a £1.5 billion loan guarantee to stabilize operations, which restarted in a phased manner by October 8, 2025. The Bank of England cited the attack as a key factor in the UK’s weaker-than-expected Q3 2025 GDP, highlighting its broader economic impact. Despite stabilization, the attack severely damaged profitability, with EBIT margins dropping to -8.6% (from 5.1% YoY) and long-term financial strain evident.

Jaguar Land Rover (JLR) suffered a devastating cyber attack in 2025 that brought the company to a complete standstill for weeks, forcing it to halt all operations. The breach disrupted production lines, supply chains, and internal systems, leading to severe financial strain. JLR had to seek government assistance to avoid mass layoffs, highlighting the attack’s catastrophic economic impact. The shutdown also triggered a ripple effect across thousands of smaller supplier businesses, which rely on JLR as a key customer, exacerbating losses across the UK’s automotive sector. While the article does not specify the exact nature of the attack (e.g., ransomware, data exfiltration, or system sabotage), the prolonged operational paralysis and financial distress suggest a high-severity incident targeting core business functions. The attack’s scale and consequences align with threats capable of jeopardizing an organization’s existence, particularly given the broader economic repercussions.

UK Cybersecurity Threat Remains High as AI Amplifies Risks, Government Report Finds The UK government’s Cyber Security Breaches Survey 2025-26 reveals persistent and severe cyber threats, with 43% of businesses, 28% of charities, and 69% of large firms reporting breaches or attacks in the past year. Nearly a third (29%) of respondents faced incidents at least weekly, underscoring the ongoing challenge. The report arrives amid a surge in high-profile attacks, including breaches at Marks & Spencer, Co-op Group, and Jaguar Land Rover, as well as growing concerns over offensive AI. Cybersecurity minister Liz Lloyd warned that AI is sharpening the threat landscape, urging business leaders to prioritize defenses. In response, the government has targeted over 180 major UK companies with a call to adopt the upcoming Cyber Resilience Pledge a voluntary initiative requiring board-level accountability, enrollment in the NCSC’s free Early Warning service, and Cyber Essentials certification across supply chains. While some trends show improvement ransomware attacks dropped to 1% from 3% the prior year, and phishing incidents fell to 38% from 42% in 2023-24 phishing remains the most common and disruptive threat. Impersonation attacks also declined, affecting 12% of businesses (down from 17% in 2023-24) and fewer charities. However, the financial and reputational fallout of breaches has worsened: 5% of businesses reported revenue or share value losses (up from 2%), while reputational damage rose to 3% from 1%. The survey highlights a paradox: while defenses may be strengthening in some areas, attackers are leveraging AI to refine tactics, keeping pressure on organizations across sectors.

UK Manufacturing Sector Hit Hard by Cyber Incidents, With 78% Affected in Past Year A recent survey of 500 UK manufacturing decision-makers, commissioned by ESET, reveals that 78% of manufacturers experienced cyber incidents in the last 12 months, with 53% reporting lost revenue as a direct consequence. The findings highlight widespread operational disruption rather than isolated IT failures, with 95% of affected companies facing tangible business impacts. Downtime and financial losses were among the most severe effects. Three-quarters of manufacturers reported full or partial shutdowns due to cyberattacks, with 56% experiencing outages of one to three days and 19% facing disruptions lasting four to seven days. Financial damage was significant over half of the most serious incidents resulted in losses of at least £250,000, while supply chains and customer relationships also suffered, with 44% citing supply chain disruption and 39% missing contractual commitments. The survey follows the cyberattack on Jaguar Land Rover, which ESET estimated cost the UK economy £1.9 billion, demonstrating how cyber disruptions in manufacturing can ripple beyond individual businesses and persist even after systems are restored. Despite the scale of the threat, cybersecurity accountability remains largely outside the boardroom. Only 22% of manufacturers assign responsibility to executive leadership, while 55% delegate it to IT teams. This divide influences spending priorities 63% recognize preventive measures as more cost-effective, yet 21% still favor reactive approaches. Visibility into operational risks is also limited, with one in five manufacturers reporting little to no insight into threats that could disrupt production. Meanwhile, the threat landscape is evolving, with 46% of respondents identifying AI-enabled attacks as a top concern over the next year, followed by phishing (42%), ransomware (40%), and unauthorized system access (38%). ESET UK Country Manager Matt Knell emphasized that many organizations still treat cybersecurity as a technical issue rather than a strategic business priority, despite evidence that reactive responses often lead to six-figure losses and prolonged disruptions. The findings suggest that manufacturers with older operational technology (OT) and newer connected systems are particularly vulnerable, as automation makes attacks easier to scale and harder to detect.

UK SMEs Hit Hardest as Ransomware Attacks Surge in 2025-26 UK organizations faced an average of 26 successful ransomware attacks per month between April 2025 and March 2026, with small and mid-sized enterprises (SMEs) bearing the brunt of the impact. According to data from Report Fraud, a cybercrime and fraud reporting service operated by City of London Police, 323 corporate victims reported incidents during the period over half of which were SMEs. Financial losses from these attacks rose sharply, increasing 50% year-on-year to approximately £270,000 ($357,000) per incident. However, authorities acknowledge this figure is likely an underestimate, as many businesses do not disclose the full extent of their losses. Among sectors that identified themselves, manufacturing reported the highest number of attacks (42), followed by scientific and technical services (21) and education (19). The UK’s ransomware crisis escalated in 2025, with high-profile breaches at companies like Marks & Spencer, Co-op Group, and Jaguar Land Rover. The attack on Jaguar Land Rover was attributed to Russian hackers, with experts suggesting the motive may have been sabotage rather than financial gain. Despite the rising threat, reporting remains inconsistent. Security experts, including Talion CEO Kevin Knight, warn that paying ransoms is often ineffective, as attackers frequently fail to return data in usable form or at all. Meanwhile, the UK government continues to debate mandatory ransomware reporting and a potential ban on payments for public sector and critical infrastructure organizations. Until such measures are implemented, the true scale of the problem will likely remain obscured.

Hasbro Hit by Cyberattack, Disrupting Operations and Raising Security Concerns Hasbro, the global toy and entertainment giant behind brands like Peppa Pig, Transformers, Monopoly, and Dungeons & Dragons, confirmed a cyberattack after detecting unauthorized access to its network on 28 March 2025. The breach forced the company to take some systems offline, leading to temporary disruptions across its websites and order fulfillment processes. In an SEC filing, Hasbro stated that while it had implemented contingency measures to maintain operations, delays in product deliveries could persist for "several weeks". By Wednesday afternoon, parts of its corporate and brand websites including Peppa Pig displayed error messages, though the company assured that business operations remained functional. It remains unclear whether the attackers are still active in Hasbro’s systems, if they made ransom demands, or if customer data was compromised. The incident follows a wave of cyberattacks targeting UK retailers around Easter 2025, including M&S, Co-op, and Harrods, as well as a later breach at Jaguar Land Rover in September. Hasbro’s attack underscores the growing vulnerability of major corporations to cyber threats, particularly as digital infrastructure becomes increasingly critical to supply chains and customer interactions. With a 103-year history and ownership of some of the world’s most recognizable toy brands, Hasbro’s response including isolating affected systems reflects the urgency of containing such breaches. However, the full scope and long-term impact of the attack remain under investigation.

Ransomware Evolves into a Global Business Threat, Fueled by AI and Multi-Layered Extortion Ransomware has transformed from a technical nuisance into a sophisticated, multi-billion-dollar business risk, targeting data, operations, and reputation with equal precision. According to BlackFog’s 2025 State of Ransomware Report, publicly disclosed attacks surged 49% year-on-year, while an untold number of incidents remain hidden highlighting the growing scale and opacity of the threat. The shift is driven by AI-powered attacks, enabling cybercriminals to conduct large-scale campaigns with unprecedented speed and accuracy. With 130 active ransomware groups impacting organizations across 135 countries, nearly every sector faces disruption. Attackers now prioritize data exfiltration and extortion over traditional encryption, exploiting weaknesses in detection-focused security tools like EDR/XDR, which fail to prevent data loss before it occurs. Double and triple extortion have become standard tactics, exposing critical gaps in organizational defenses. Many victims discover breaches only after data has been stolen often days or months after initial infiltration while backups, though useful for system recovery, do little to address the long-term fallout of stolen intellectual property or customer data. The consequences extend far beyond IT downtime, triggering legal, regulatory, reputational, and financial repercussions that persist for years. Current incident response strategies designed to contain and restore are ill-equipped for this new landscape. As BlackFog CEO Dr. Darren Williams notes, recovery efforts often overlook the core objective of ransomware: disrupting business operations and leveraging stolen data for extortion. While governments universally advise against paying ransoms, the pressure to do so remains intense, particularly when attackers threaten to leak sensitive data or cripple critical infrastructure. Cyber insurance has also reshaped attacker behavior, with ransom demands often aligning with typical policy limits. While insurers now enforce stricter security requirements, some organizations still rely on coverage as a crutch rather than investing in preventative measures, such as real-time data exfiltration protection. The report underscores that legacy security vendors, including major providers like Microsoft, struggle to keep pace with AI-driven threats, leaving gaps that nimble, specialized firms are increasingly filling. The path forward requires a proactive, data-centric approach. Organizations must shift from reactive recovery to resilience by design, prioritizing real-time defense against data exfiltration the linchpin of modern ransomware attacks. Without it, even restored systems leave businesses vulnerable to prolonged fallout, from regulatory fines to lasting reputational damage. High-profile cases, such as those affecting Marks & Spencer and Jaguar Land Rover, serve as cautionary examples of how unprepared organizations can spiral into operational and financial chaos. As ransomware continues to evolve, the focus must move beyond detecting intrusions to preventing the theft of data the true currency of cyber extortion.

Ransomware in 2025: A Systemic Threat Disrupting Global Supply Chains and Critical Services In 2025, ransomware evolved from isolated IT disruptions into a systemic risk, threatening national supply chains, essential services, and entire industries. Cybersecurity Ventures projects the global cost of ransomware will surge to $275 billion annually by 2031, driven by downtime, data loss, recovery efforts, and lost productivity not just ransom payments. A recent SOCRadar analysis highlighted the top 10 ransomware attacks of 2025, each exposing vulnerabilities across sectors: 1. Salesforce Ecosystem – A SaaS supply chain blind spot exploited for widespread disruption. 2. Oracle E-Business Suite – A zero-day attack leveraging supply chain extortion. 3. Jaguar Land Rover – Britain’s costliest cyberattack, crippling automotive operations. 4. Ingram Micro – A ransomware strike paralyzing global IT distribution. 5. Co-operative Group – A sustained siege on the UK retail sector. 6. PowerSchool – Large-scale extortion targeting the education sector. 7. Synnovis – Healthcare disruption with confirmed patient harm. 8. DaVita – Ransomware striking critical healthcare infrastructure. 9. Asahi Group – Manufacturing halts exposing IT-OT convergence risks. 10. Collins Aerospace – Ransomware grounding European airports. Key patterns emerged across these incidents: - Initial access frequently relied on stolen credentials or social engineering rather than sophisticated exploits. - Supply chain vulnerabilities amplified impact, turning single breaches into cascading failures. - Data theft and operational paralysis often outweighed encryption as the primary damage driver. - Delayed consequences such as regulatory penalties or confirmed human harm surfaced months after the attacks. The incidents underscore ransomware’s growing role as a strategic threat, with far-reaching consequences beyond financial losses.

Jaguar Land Rover (JLR) suffered a severe cyber attack that forced the company to extend its production pause until October 1, 2024. The incident disrupted operations for over three weeks, significantly impacting the automaker’s supply chain, suppliers, and retailers. JLR is collaborating with cybersecurity specialists, the UK’s National Cyber Security Centre (NCSC), and law enforcement to investigate and restore secure operations. The UK government is assessing the broader economic impact, as prolonged halts have strained supplier businesses. The attack’s scale suggests critical operational disruptions, with potential long-term financial and reputational damage. While no specific data breach details were disclosed, the prolonged outage indicates a high-severity incident threatening core business continuity.

Jaguar Land Rover (JLR) suffered a major cyber attack in early September 2024, forcing a complete shutdown of its manufacturing operations for weeks. The attack disrupted production lines, idling over 33,000 UK employees and halting vehicle assembly. Estimates suggest JLR is losing £50 million per week in lost production, with supply chain partners—some entirely dependent on JLR—facing potential closure and job losses. The UK government intervened with a £1.5 billion loan guarantee to stabilize the company and its suppliers. While JLR is gradually resuming partial operations, the attack exposed vulnerabilities in its just-in-time manufacturing model, requiring collaboration with cybersecurity experts, the NCSC (National Cyber Security Centre), and law enforcement to secure systems. The incident follows a wave of high-profile cyberattacks on UK businesses, including Marks & Spencer, Co-op, and Harrods, underscoring systemic risks to critical industries.

Massive Cyberattack on Transport for London Exposes Data of 10 Million Customers In one of the largest data breaches in British history, Transport for London (TfL) confirmed that a cyberattack in late 2024 compromised the personal data of approximately 10 million customers. The breach, which occurred between August 29 and September 6, was discovered on September 1, prompting TfL to notify over 7 million customers via email in September those for whom email addresses were available in the exposed dataset. While the attack did not disrupt London’s transport networks, it caused three months of online service outages, resulting in financial losses estimated in the tens of millions of pounds. The stolen data included customer names and contact details, with a smaller subset around 5,000 individuals having bank account information potentially accessed. Investigators linked the attack to Scattered Spider, a notorious cybercriminal collective. Two British teenagers, previously charged in connection with the breach, are set to stand trial in June 2025. The incident reflects a broader surge in cyberattacks targeting UK organizations, with recent victims including Marks & Spencer, the Co-op, and Jaguar Land Rover.

The cyber-attack on Jaguar Land Rover (JLR) in August 2024 is considered the most economically damaging in British history, with estimated losses exceeding £1.9 billion and potential for further financial escalation. The attack forced a complete shutdown of all factories and offices globally, including key UK sites (Halewood, Solihull, Castle Bromwich) and international locations (China, Slovakia, Brazil). Production remained crippled for months, with only a limited restart in early October and full recovery not expected until January 2025.The disruption extended to 5,000 supplier organizations across the UK, leading to mass layoffs, cashflow crises, and supply chain collapses. Smaller suppliers, lacking JLR’s financial resilience (backed by parent company Tata Group), bore severe operational and economic strain. The UK government intervened with a £1.5bn loan guarantee to stabilize the supply chain, while JLR pre-paid for parts to mitigate downstream damage. Analysts estimated daily losses of £50 million during the shutdown.The Cyber Monitoring Centre (CMC) classified the incident as a category 3 systemic event, highlighting its systemic risk to the UK economy due to lost manufacturing output, supply chain paralysis, and downstream impacts on dealerships. Reports also indicated JLR lacked active cyber insurance during the attack, exacerbating financial exposure. The hack underscored vulnerabilities in critical industrial networks and the cascading economic consequences of large-scale cyber disruptions.

Jaguar Land Rover (JLR) suffered a severe cyberattack in early 2024, resulting in a £196 million ($220 million) financial loss in the quarter ending September 30. The attack disrupted operations, caused manufacturing delays, and forced reliance on manual processes, severely impacting productivity. The incident was linked to a ransomware attack (likely LockBit) targeting Tata Consultancy Services (TCS), a critical supplier, though JLR did not confirm ransom payments. Recovery costs included IT restoration, investigation, containment, and process inefficiencies. While no direct customer data breach occurred, the attack crippled back-office systems, supply chain communications, and production planning, leading to a £15 million pre-tax loss (down from a £442 million profit in the prior quarter). The case highlights the escalating cyber risks in automotive manufacturing, where third-party vulnerabilities and operational disruptions can inflict massive financial and reputational damage.

Jaguar Land Rover (JLR) suffered a major cyberattack in late August 2024, attributed to the criminal gang Scattered Lapsus$ Hunters. The attack exploited a vulnerability in SAP Netweaver, forcing JLR to shut down global manufacturing sites (UK, China, India, Brazil, Slovakia) for weeks. The disruption halted production of ~1,000 vehicles/day, costing an estimated £5M/day in lost profits and 30,000+ 'lost' vehicles that cannot be recovered. Supply chain collapse triggered layoffs, short-time work schedules, and financial strain across 13,000+ jobs in the UK’s automotive sector, with suppliers facing 16% loan interest rates and emergency bank guarantees. The UK government intervened with a £1.5B emergency loan to stabilize suppliers, marking an unprecedented bailout for a private, foreign-owned firm. The attack exposed legacy IT vulnerabilities from JLR’s Ford-era infrastructure, compounded by prior unaddressed warnings (e.g., June 2024 credential leaks by Deep Specter Research) and a March 2024 ransomware breach linked to the same hackers. Recovery remains slow, with weeks needed to restore full capacity and long-term reputational damage.

Jaguar Land Rover (JLR), owned by Tata Motors, suffered a severe cyber attack in early September 2023, forcing the shutdown of multiple factories globally, including in the UK, Slovakia, Brazil, and India. The attack disrupted production, supply chains, and financial operations, leading to a backlog of supplier invoices, delayed parts distribution, and stalled vehicle sales/registrations. The UK government intervened with a $2 billion loan guarantee to mitigate the financial fallout, aiming to safeguard 34,000 direct jobs and 120,000 supply-chain roles tied to JLR. The incident contributed to Tata Group losing over $75 billion in market value this year, with the JLR shutdown cited as a key factor. While partial systems were restored by late September, full recovery remains ongoing, with phased production resumption announced in early October. Small suppliers dependent on JLR also faced operational disruptions, compounding the economic impact.

The cyber attack on Jaguar Land Rover (JLR) in late August 2023 became the most financially damaging cyber event in British history, with estimated losses between £1.6 billion and £2.1 billion (most likely £1.9 billion). The attack shut down JLR’s global IT systems, halting vehicle production at major UK plants (Solihull, Halewood, Wolverhampton) for five weeks, resulting in a weekly loss of 5,000 vehicles and £108 million in fixed costs and lost profit per week. Over 5,000 UK organizations were affected, including supply chain disruptions (tier 1, 2, and 3 suppliers), dealership sales losses, and local business impacts due to staff shortages. The human impact included job insecurity, pay cuts, and layoffs among suppliers. While production resumed, long-term financial risks remained if operational technology (OT) was compromised or recovery delays persisted. The UK government intervened with a £1.5 billion loan guarantee to stabilize JLR’s liquidity, raising questions about future state support thresholds for critical economic sectors.

Jaguar Land Rover (JLR), a prominent UK-based automotive manufacturer, fell victim to a sophisticated AI-driven ransomware attack in the past year, contributing to the broader wave of high-profile incidents targeting major British enterprises. The attack, likely accelerated by AI-powered tools, resulted in significant operational disruption and data loss, aligning with trends highlighted in CrowdStrike’s report where 78% of organizations faced ransomware in 2023. JLR’s incident exacerbated financial strain, with the UK economy losing billions due to such attacks on critical sectors. The breach compromised sensitive corporate and customer data, with recovery efforts hampered by the attackers’ ability to bypass traditional defenses. Despite potential ransom payments, the company likely experienced repeated attacks (as seen in 83% of cases) and incomplete data restoration (affecting 40% of firms). The incident underscored vulnerabilities in JLR’s incident response, as only 38% of victims addressed root causes post-attack. The financial and reputational damage extended beyond immediate losses, impacting supply chains and customer trust in a highly competitive industry.

Jaguar Land Rover (JLR) suffered a late-summer cyberattack that severely disrupted automotive production for weeks, forcing a phased restart in early October. The attack occurred in September 2023, a critical month marking the start of the 2026 Range Rover model year and the U.K.’s new vehicle registration plate period. Revenue plummeted 24% year-over-year to $6.45 billion, with wholesale units dropping 24% due to halted operations. The incident crippled JLR’s supply chain, impacting ~5,000 organizations and prompting a $659 million emergency financing package for suppliers. The British economy lost an estimated $2.5 billion, leading U.K. officials to intervene with a stabilization loan.The attack, suspected to be a social engineering breach by a threat group linked to the April 2023 Marks & Spencer hack, caused $313 million in exceptional costs, including recovery expenses and a voluntary cost-cutting program. JLR reported a $638 million pre-tax loss and a $735 million net loss for the quarter. Production shutdowns, delayed model launches, and supply chain chaos underscored the attack’s operational and financial devastation, with Moody’s warning of escalating third-party cyber risks in Europe’s interconnected manufacturing networks.

A massive data leak has revealed the personnel files of hundreds of employees at Jaguar Land Rover's factory in Solihull, England. The documents reveal details such as sick days used, disciplinary issues, and most notably red lines indicating potential firings in the weeks or months ahead. The personal records of more than 600 workers were released. The main culprits include a huge slump in sales of diesel-powered vehicles, a vital part of JLR's business in the U.K. and throughout Europe along with fears about how the upcoming "Brexit" will affect business operations.

A catastrophic cyberattack on Jaguar Land Rover, the UK’s largest automaker, disrupted its global manufacturing operations, halting production lines for weeks across at least three UK plants. The attack also crippled dealer systems, causing intermittent unavailability, and led to cancelled or delayed orders for suppliers, creating widespread uncertainty. The financial toll reached an estimated £1.9 billion ($2.5 billion), surpassing the economic damage of the 2017 WannaCry attack. The incident was severe enough to reduce the UK’s GDP growth by 0.2% in the quarter, per the Bank of England, marking it as the most economically devastating cyberattack in British history. While no customer data theft was confirmed, the attack paralyzed industrial production—a rare and extreme outcome for cyber incidents. Evidence suggests the attack involved ransomware, with hackers encrypting systems and demanding payment for restoration, though the company took nearly a month to partially resume operations. The ripple effects extended to dealerships, parts suppliers, and export markets, notably the U.S.

Jaguar Land Rover (JLR) suffered a major cyberattack in September 2025, attributed to the hacking group Scattered Lapsus$ Hunters. The attack exploited a known vulnerability (CVE-2015-2291) in Intel’s Ethernet Diagnostics Driver, leading to widespread disruption across manufacturing, IT systems, and dealership operations. Key production sites in the UK (Solihull, Halewood) and international facilities were forced to halt vehicle production, while dealerships faced issues registering new vehicles. The company proactively shut down IT systems to contain the breach, but recovery is expected to take weeks, with significant financial losses due to downtime (millions per day), supply chain disruptions, and potential regulatory fines under GDPR. The attack highlights vulnerabilities in JLR’s just-in-time logistics and interconnected supply chain, where a single breach cascaded into operational paralysis. The incident marks the second cyberattack on JLR in 2025, following an earlier ransomware attack by HELLCAT. Experts warn of long-term reputational damage, erosion of customer trust, and heightened scrutiny from regulators. The company is now prioritizing cybersecurity upgrades, including identity-based attack defenses and resilience measures, as the automotive sector faces escalating threats from sophisticated hacking collectives.