Loading story…
Jaguar Land Rover (JLR), one of the United Kingdom's most prominent car manufacturers, suffered a significant cyberattack that brought its production lines to a halt across multiple sites, including Solihull, Wolverhampton, and Halewood. The attack, attributed to a group known as Scattered Lapsus$ Hunters, effectively took control of JLR’s manufacturing operations, resulting in a complete production stoppage for nearly a month. This disruption led to estimated financial losses of approximately £50 million per week, severely impacting not only JLR but also its extensive supply chain, which was pushed to the brink of bankruptcy. The scale and duration of the attack highlighted critical vulnerabilities in JLR’s cybersecurity posture, raising questions about the adequacy of its cyber risk management and preparedness. In response to the escalating crisis and the potential for widespread economic fallout, the UK government intervened with an unprecedented £1.5 billion loan guarantee to support the company. This move was justified by officials as necessary to protect jobs and stabilize the broader manufacturing sector, given JLR’s role in supporting over 800,000 jobs nationwide. The government’s intervention marked the first time a UK company received such substantial financial support specifically due to a cyber incident, setting a new precedent in the intersection of national economic security and cybersecurity. The bailout sparked debate over whether such government action might inadvertently encourage lax cybersecurity practices among large firms, knowing that public funds could be used as a safety net. The incident also brought to light the broader issue of cyberattack frequency and severity affecting UK businesses, with many organizations facing similar threats due to weak security controls and insufficient investment in cyber defense. The JLR case underscored the potential for cyberattacks to cause not only direct financial losses but also systemic risks to national industries and employment. It prompted calls for stronger regulatory oversight and more robust cybersecurity requirements for critical sectors. The event also served as a wake-up call for other UK businesses to reassess their cyber resilience and incident response capabilities. The government’s decision was framed as a measure to protect livelihoods, but it also raised concerns about the long-term implications for public policy and corporate accountability. The attack and subsequent bailout have become a focal point for discussions on the true extent of cyber threats facing UK businesses and the adequacy of current defenses. The situation has led to increased scrutiny of both private sector cybersecurity practices and the role of government in mitigating the fallout from major cyber incidents. As the dust settles, the JLR cyberattack is likely to influence future approaches to cyber risk management, public-private collaboration, and the allocation of responsibility for cybersecurity failures.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
On October 6, 2025, Jaguar Land Rover started bringing operations back online after about a month of disruption. The restart began with the Wolverhampton engine factory, with other assembly lines scheduled to return in phases.
Amid concern over job losses and supply-chain damage, the U.K. government guaranteed a £1.5 billion loan to Jaguar Land Rover, repayable over five years. Unions and industry groups warned the support might still be insufficient for a full recovery, and some suppliers said funds had not reached beyond first-tier firms.
Aston Martin said a cyber incident at a major U.K. automotive manufacturer contributed to reduced Q3 wholesale volume projections. The statement showed the Jaguar Land Rover disruption had spilled over into the wider automotive supply chain.
A group calling itself "Scattered Lapsus$ Hunters" claimed responsibility for the Jaguar Land Rover attack. The group later said in mid-September that it was shutting down, though that closure was described as disputed.
On September 1, 2025, a cyberattack hit Jaguar Land Rover and triggered widespread disruption across multiple countries. Manufacturing and dealership operations were affected, and the company reportedly could not book sales from that point.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
bbc.com
Open sourcebankinfosecurity.com
Open sourceinfosecwriteups.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jaguar Land Rover (JLR) suffered a major cyberattack that resulted in the shutdown of its manufacturing operations for over a month, causing significant disruption across its supply chain and dealership network. The incident, which began in late August 2025, affected JLR’s IT systems and halted production at key plants in Solihull, Halewood, and Wolverhampton. More than 5,000 organizations in the UK were impacted, including suppliers and downstream businesses, as orders were canceled or delayed and dealer systems went offline. The Cyber Monitoring Centre (CMC), a nonprofit specializing in cyber incident analysis, estimated the economic impact at £1.9 billion ($2.5 billion), making it the most economically damaging cyber event in UK history. The CMC classified the event as a "Category 3 systemic event," indicating a severe but not the highest level of national impact. The financial estimate was based on a modeled range of £1.6 billion to £2.1 billion and only considered the UK, suggesting the global impact could be even greater. The disruption to JLR’s operations threatened the viability of businesses in its supply chain, putting thousands of jobs at risk and prompting calls for government intervention. In response, the UK government provided emergency financial support amounting to £1.5 billion to help JLR recover and stabilize its operations, although the CMC noted that the full cost to taxpayers might not materialize if the support is not fully utilized. JLR also launched a financing scheme to provide up-front cash to suppliers facing financial hardship due to the shutdown. The incident highlighted the systemic risk posed by cyberattacks to critical manufacturing sectors and the broader economy, with experts warning that cyber resilience is now a matter of national security. The event underscored the interconnectedness of modern supply chains and the cascading effects a single cyber incident can have across multiple industries. The CMC’s analysis emphasized the need for organizations to strengthen their cyber defenses to prevent similar large-scale disruptions in the future. The government’s intervention in this case could set a precedent for future responses to major cyber incidents affecting national infrastructure. The attack’s impact on JLR, which accounts for roughly 4% of all British goods exports, demonstrates the potential for cyber threats to undermine key economic sectors. The event has sparked debate about the adequacy of current cyber insurance and risk management practices in the face of systemic cyber threats. Industry leaders and policymakers are now reassessing strategies to bolster cyber resilience and protect critical supply chains from future attacks. The JLR cyberattack serves as a stark warning of the far-reaching consequences of cyber incidents on both organizational and national levels.
Jun 29, 2026
Jaguar Land Rover (JLR) suffered a major ransomware attack attributed to the HellCat group, which began on August 31 and resulted in the shutdown of production lines at all of its factories worldwide. The attack crippled critical systems, including computer-aided design (CAD), engineering software, product life-cycle management, payments tracking, and customer car delivery platforms, severely impacting the company’s ability to operate. As a result, JLR halted all vehicle manufacturing, and the disruption extended to its extensive supply chain, affecting hundreds of small companies that provide parts and services. Many of these suppliers faced severe financial distress, with some on the brink of bankruptcy due to the sudden loss of business and cash flow. The economic impact of the attack was significant, with JLR reportedly losing an estimated £50 million per week and the broader supply chain, employing around 150,000 people across 700 British firms, also suffering. In response to the crisis, the UK government agreed to underwrite a £1.5 billion loan to JLR through the Export Development Guarantee (EDG) program, aiming to stabilize the company and protect jobs throughout the supply chain. The loan, issued by a commercial bank and guaranteed by the government, is intended to help JLR support its suppliers and maintain skilled employment in key regions such as the West Midlands and Merseyside. UK Business Secretary Peter Kyle and Chancellor Rachel Reeves both emphasized the importance of the loan in safeguarding the British automotive sector. The Unite union, representing thousands of workers at JLR and its suppliers, welcomed the government’s intervention as a crucial step. JLR began restoring some IT systems in late September, enabling partial resumption of payment processing to suppliers, but full production was not expected to resume until at least October 1. The company’s lack of cyber insurance reportedly exacerbated the financial fallout. The attack not only disrupted JLR’s internal operations but also created significant challenges for retailers and parts ordering, further amplifying the economic consequences. The incident highlighted the vulnerability of complex manufacturing supply chains to cyber threats and underscored the need for robust cybersecurity and contingency planning. The UK government’s swift action to guarantee the loan was seen as essential to preventing further economic damage and supporting the recovery of both JLR and its network of suppliers. The event has raised concerns about the resilience of critical industries to ransomware attacks and the broader implications for national economic stability. JLR’s experience serves as a stark reminder of the far-reaching impact a single cyber incident can have on a major manufacturer and its ecosystem.
Jun 29, 2026
The UK government backed a **£1.5 billion loan guarantee** to help Jaguar Land Rover recover from a major cyberattack that shut production plants, disrupted invoicing, and rippled through the automotive supply chain. The support, provided through a commercial bank and backed by UK Export Finance, was designed to protect an estimated **120,000 jobs** as suppliers and local businesses faced mounting losses, with some already entering redundancy proceedings. Commentators described the incident as one of JLR’s worst crises, with the company reportedly losing **£5 million to £10 million per day** while manufacturing remained halted. At a Cyber Monitoring Centre event, UK cyber officials and industry representatives warned that the JLR rescue could set a **dangerous precedent** if future state intervention occurs without a clear policy framework. The CMC estimated the JLR incident cost as much as **£1.9 billion**, while separate attacks on Marks & Spencer and the Co-op added another **£355 million** in losses, highlighting the widening economic impact of cyber incidents in the UK. Speakers said the cyber insurance market cannot absorb most large-scale losses, with estimates of a protection gap of up to **90 percent**, and urged structured measures such as mandatory insurance, tax incentives, or a government-backed safety net rather than ad hoc bailouts.
Jun 29, 2026