Loading story…
The UK government backed a £1.5 billion loan guarantee to help Jaguar Land Rover recover from a major cyberattack that shut production plants, disrupted invoicing, and rippled through the automotive supply chain. The support, provided through a commercial bank and backed by UK Export Finance, was designed to protect an estimated 120,000 jobs as suppliers and local businesses faced mounting losses, with some already entering redundancy proceedings. Commentators described the incident as one of JLR’s worst crises, with the company reportedly losing £5 million to £10 million per day while manufacturing remained halted.
At a Cyber Monitoring Centre event, UK cyber officials and industry representatives warned that the JLR rescue could set a dangerous precedent if future state intervention occurs without a clear policy framework. The CMC estimated the JLR incident cost as much as £1.9 billion, while separate attacks on Marks & Spencer and the Co-op added another £355 million in losses, highlighting the widening economic impact of cyber incidents in the UK. Speakers said the cyber insurance market cannot absorb most large-scale losses, with estimates of a protection gap of up to 90 percent, and urged structured measures such as mandatory insurance, tax incentives, or a government-backed safety net rather than ad hoc bailouts.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
The Cyber Monitoring Centre said it was broadening its work through post-incident business polling with the Office for National Statistics, a forthcoming white paper on cloud risk, and plans to establish a US cyber monitoring center. These steps were presented as part of improving measurement of cyber incident impacts.
At the Cyber Monitoring Centre's first-year event, UK cyber officials and industry representatives warned that the government's intervention for JLR could create a problematic precedent if future support is provided without a clear policy framework. Speakers argued ad hoc bailouts could weaken incentives for private-sector cyber resilience and insurance uptake.
By the time of the Cyber Monitoring Centre's first-year event, the CMC said the Jaguar Land Rover incident had caused losses of as much as £1.9 billion. The estimate was cited alongside other major UK retail cyber incidents to illustrate the growing economic impact of cyberattacks.
The UK government announced a £1.5 billion government-backed loan guarantee for Jaguar Land Rover, structured through a commercial bank and backed by UK Export Finance's Export Development Guarantee. The support was intended to stabilize JLR and protect its supply chain after the cyberattack.
As the disruption continued, suppliers and local businesses tied to JLR were hit hard, with officials warning that around 120,000 jobs were at risk and some suppliers entering redundancy proceedings. Commentators said JLR was losing an estimated £5-10 million per day while production remained halted.
Jaguar Land Rover's cyberattack disrupted production and invoicing systems, with company plants reported closed from August 31. The outage triggered downstream disruption across the UK automotive supply chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jaguar Land Rover (JLR), one of the United Kingdom's most prominent car manufacturers, suffered a significant cyberattack that brought its production lines to a halt across multiple sites, including Solihull, Wolverhampton, and Halewood. The attack, attributed to a group known as Scattered Lapsus$ Hunters, effectively took control of JLR’s manufacturing operations, resulting in a complete production stoppage for nearly a month. This disruption led to estimated financial losses of approximately £50 million per week, severely impacting not only JLR but also its extensive supply chain, which was pushed to the brink of bankruptcy. The scale and duration of the attack highlighted critical vulnerabilities in JLR’s cybersecurity posture, raising questions about the adequacy of its cyber risk management and preparedness. In response to the escalating crisis and the potential for widespread economic fallout, the UK government intervened with an unprecedented £1.5 billion loan guarantee to support the company. This move was justified by officials as necessary to protect jobs and stabilize the broader manufacturing sector, given JLR’s role in supporting over 800,000 jobs nationwide. The government’s intervention marked the first time a UK company received such substantial financial support specifically due to a cyber incident, setting a new precedent in the intersection of national economic security and cybersecurity. The bailout sparked debate over whether such government action might inadvertently encourage lax cybersecurity practices among large firms, knowing that public funds could be used as a safety net. The incident also brought to light the broader issue of cyberattack frequency and severity affecting UK businesses, with many organizations facing similar threats due to weak security controls and insufficient investment in cyber defense. The JLR case underscored the potential for cyberattacks to cause not only direct financial losses but also systemic risks to national industries and employment. It prompted calls for stronger regulatory oversight and more robust cybersecurity requirements for critical sectors. The event also served as a wake-up call for other UK businesses to reassess their cyber resilience and incident response capabilities. The government’s decision was framed as a measure to protect livelihoods, but it also raised concerns about the long-term implications for public policy and corporate accountability. The attack and subsequent bailout have become a focal point for discussions on the true extent of cyber threats facing UK businesses and the adequacy of current defenses. The situation has led to increased scrutiny of both private sector cybersecurity practices and the role of government in mitigating the fallout from major cyber incidents. As the dust settles, the JLR cyberattack is likely to influence future approaches to cyber risk management, public-private collaboration, and the allocation of responsibility for cybersecurity failures.
Jun 29, 2026
Jaguar Land Rover (JLR) suffered a major cyberattack that resulted in the shutdown of its manufacturing operations for over a month, causing significant disruption across its supply chain and dealership network. The incident, which began in late August 2025, affected JLR’s IT systems and halted production at key plants in Solihull, Halewood, and Wolverhampton. More than 5,000 organizations in the UK were impacted, including suppliers and downstream businesses, as orders were canceled or delayed and dealer systems went offline. The Cyber Monitoring Centre (CMC), a nonprofit specializing in cyber incident analysis, estimated the economic impact at £1.9 billion ($2.5 billion), making it the most economically damaging cyber event in UK history. The CMC classified the event as a "Category 3 systemic event," indicating a severe but not the highest level of national impact. The financial estimate was based on a modeled range of £1.6 billion to £2.1 billion and only considered the UK, suggesting the global impact could be even greater. The disruption to JLR’s operations threatened the viability of businesses in its supply chain, putting thousands of jobs at risk and prompting calls for government intervention. In response, the UK government provided emergency financial support amounting to £1.5 billion to help JLR recover and stabilize its operations, although the CMC noted that the full cost to taxpayers might not materialize if the support is not fully utilized. JLR also launched a financing scheme to provide up-front cash to suppliers facing financial hardship due to the shutdown. The incident highlighted the systemic risk posed by cyberattacks to critical manufacturing sectors and the broader economy, with experts warning that cyber resilience is now a matter of national security. The event underscored the interconnectedness of modern supply chains and the cascading effects a single cyber incident can have across multiple industries. The CMC’s analysis emphasized the need for organizations to strengthen their cyber defenses to prevent similar large-scale disruptions in the future. The government’s intervention in this case could set a precedent for future responses to major cyber incidents affecting national infrastructure. The attack’s impact on JLR, which accounts for roughly 4% of all British goods exports, demonstrates the potential for cyber threats to undermine key economic sectors. The event has sparked debate about the adequacy of current cyber insurance and risk management practices in the face of systemic cyber threats. Industry leaders and policymakers are now reassessing strategies to bolster cyber resilience and protect critical supply chains from future attacks. The JLR cyberattack serves as a stark warning of the far-reaching consequences of cyber incidents on both organizational and national levels.
Jun 29, 2026
Jaguar Land Rover (JLR) suffered a major ransomware attack attributed to the HellCat group, which began on August 31 and resulted in the shutdown of production lines at all of its factories worldwide. The attack crippled critical systems, including computer-aided design (CAD), engineering software, product life-cycle management, payments tracking, and customer car delivery platforms, severely impacting the company’s ability to operate. As a result, JLR halted all vehicle manufacturing, and the disruption extended to its extensive supply chain, affecting hundreds of small companies that provide parts and services. Many of these suppliers faced severe financial distress, with some on the brink of bankruptcy due to the sudden loss of business and cash flow. The economic impact of the attack was significant, with JLR reportedly losing an estimated £50 million per week and the broader supply chain, employing around 150,000 people across 700 British firms, also suffering. In response to the crisis, the UK government agreed to underwrite a £1.5 billion loan to JLR through the Export Development Guarantee (EDG) program, aiming to stabilize the company and protect jobs throughout the supply chain. The loan, issued by a commercial bank and guaranteed by the government, is intended to help JLR support its suppliers and maintain skilled employment in key regions such as the West Midlands and Merseyside. UK Business Secretary Peter Kyle and Chancellor Rachel Reeves both emphasized the importance of the loan in safeguarding the British automotive sector. The Unite union, representing thousands of workers at JLR and its suppliers, welcomed the government’s intervention as a crucial step. JLR began restoring some IT systems in late September, enabling partial resumption of payment processing to suppliers, but full production was not expected to resume until at least October 1. The company’s lack of cyber insurance reportedly exacerbated the financial fallout. The attack not only disrupted JLR’s internal operations but also created significant challenges for retailers and parts ordering, further amplifying the economic consequences. The incident highlighted the vulnerability of complex manufacturing supply chains to cyber threats and underscored the need for robust cybersecurity and contingency planning. The UK government’s swift action to guarantee the loan was seen as essential to preventing further economic damage and supporting the recovery of both JLR and its network of suppliers. The event has raised concerns about the resilience of critical industries to ransomware attacks and the broader implications for national economic stability. JLR’s experience serves as a stark reminder of the far-reaching impact a single cyber incident can have on a major manufacturer and its ecosystem.
Jun 29, 2026