Loading story…
Jaguar Land Rover (JLR) suffered a major cyberattack in August that not only halted its manufacturing operations for over a month but also resulted in the theft of sensitive payroll data belonging to current and former employees, as well as contractors. The compromised information includes bank account details, tax codes, and other personal data used for payroll, benefits, and staff schemes. JLR has notified affected individuals and is working with regulators, while also providing support such as credit and identity monitoring services. The company has stated there is no evidence of misuse of the stolen data so far, but has advised vigilance against potential fraud and phishing attempts.
The financial impact of the breach has been severe, with JLR reporting a £1.5 billion drop in sales and an additional £196 million in exceptional losses linked to the incident. The disruption extended beyond JLR, affecting its supply chain and prompting government intervention to secure the company's financial stability. The attack has been described as one of the most costly in UK history, with significant repercussions for the broader UK economy, including a measurable effect on GDP growth and thousands of jobs at risk.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
On or before December 15, 2025, JLR publicly confirmed that the August cyberattack compromised data belonging to current and former employees and contractors. The company said it had notified regulators and affected individuals and was offering support services including credit and identity monitoring.
After the shutdown's wider economic effects became clear, the British government intervened with a loan to support JLR's suppliers. The disruption was estimated to have affected more than 5,000 organizations and imposed a multibillion-pound impact on the UK economy.
By late September 2025, JLR had restored operations after the prolonged shutdown caused by the cyberattack. The recovery followed weeks of manufacturing disruption and ongoing forensic investigation.
During the August 2025 incident, attackers stole sensitive data belonging to current and former employees and contractors. Reported exposed information included payroll and HR records such as bank account details, tax codes, salaries, addresses, and National Insurance numbers.
In August 2025, Jaguar Land Rover suffered a major cyberattack that forced production stoppages across multiple UK plants. The disruption lasted for more than a month and delayed vehicle deliveries across the company's supply chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetherecord.media
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jaguar Land Rover (JLR), owned by Tata Motors, suffered a significant cyberattack that forced the shutdown of major production plants in the UK, resulting in exceptional costs of approximately £196 million ($220–258 million) for the quarter ending September 30. The attack, claimed by the Scattered Lapsus$ Hunters group, led to the theft of company data, halted manufacturing operations, and caused severe liquidity issues for both JLR and some of its suppliers. The disruption persisted for weeks, with the UK government stepping in to provide a £1.5 billion loan guarantee to stabilize the supply chain and facilitate a phased restart of production by early October. The financial impact of the incident was substantial, with JLR's quarterly revenue dropping from £6.5 billion to £4.9 billion year-over-year, and profitability turning negative. The company reported a loss before tax and exceptional items of £485 million for Q2, compared to a profit of £398 million the previous year. The Bank of England cited the JLR cyberattack as a key factor in the country's weaker-than-expected GDP for Q3 2025. Despite the disruption, JLR has since restored its operations, including wholesale, parts logistics, and supplier financing, and has maintained its investment spending levels.
Jun 29, 2026Jaguar Land Rover (JLR) suffered a major cyberattack in early September 2025, forcing the shutdown of IT systems and halting production across multiple global sites. The attack, claimed by the 'Scattered Lapsus$ Hunters' group, resulted in significant operational disruption and the confirmed theft of some internal data. JLR is working with cybersecurity specialists and authorities to investigate and restore operations, while the full impact on data and business continuity is still being assessed.
Jun 29, 2026
Jaguar Land Rover (JLR), the luxury automotive manufacturer and subsidiary of Tata Motors, experienced a significant operational outage due to a major cyberattack that forced the company to shut down its manufacturing systems. The incident led to a month-long disruption, with JLR initiating a controlled, phased restart of its manufacturing operations only after extensive downtime. Initially, the company stated that customer data did not appear to be compromised, but this position was revised a week later, indicating evolving understanding of the breach’s impact. Financially, the attack was devastating, with estimated losses ranging from $50 million to $70 million per week, and the total cost projected between $1.7 billion and $2.4 billion. The attack not only halted production but also highlighted the vulnerability of even large, resource-rich corporations to operationally crippling cyber incidents. Industry experts noted that this event went far beyond typical data theft, resulting in a complete operational outage that severely impacted JLR’s supply chain and business continuity. The British government responded by guaranteeing a £1.5 billion (approximately $2 billion) commercial bank loan to JLR, providing financial support as the company and its suppliers worked to recover from the disruption. This government-backed loan is structured so that JLR is responsible for repayment, but the lender is protected by the government guarantee in case of default. The incident has been cited as a case study in the high costs and business risks associated with ransomware and other forms of cyberattacks targeting critical manufacturing operations. Experts warn that automakers are increasingly attractive targets for ransomware gangs, as operational outages can pressure companies into paying ransoms quickly. Historical context shows that other major automakers, such as Honda, have also suffered significant outages due to cyberattacks, underscoring the sector’s susceptibility. The JLR attack has prompted renewed calls for robust incident response planning, improved cyber resilience, and greater investment in cybersecurity for operational technology environments. The event also demonstrates the potential for cyber incidents to have cascading effects across national economies, prompting government intervention to stabilize affected industries. As JLR resumes operations, the long-term impact on its reputation, supply chain relationships, and financial health remains under close scrutiny by industry observers and stakeholders.
Jun 29, 2026