Loading story…
Make UK reported that nearly one-third of UK manufacturers experienced a cyber incident directly or through their supply chain during the past year, yet only around half had an incident-response plan. Production downtime and increased operating costs were the most common effects of disruptive incidents, while compromises affecting suppliers led to delayed deliveries and shortages of components and materials.
The findings highlight the operational consequences of enterprise and supply-chain attacks, including the 2025 Jaguar Land Rover incident, which disrupted manufacturing operations and affected suppliers. Manufacturers should pair preventative controls with operationally focused response plans, supplier assurance, offline operating procedures, and regularly tested recovery capabilities to sustain production during cyber disruption.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Jaguar Land Rover experienced a cyberattack in 2025 that led it to shut down global systems, severely disrupting its manufacturing and retail operations and affecting suppliers.
The UK government provided a £1.5 billion loan guarantee intended to support companies affected by the Jaguar Land Rover shutdown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcemakeuk.org
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Make UK study found that **30% of UK manufacturers** suffered a cyber incident in the past year, either directly or through their supply chain, underscoring continued exposure across the sector. The report said cyber resilience remains uneven: only about half of manufacturers have an incident response plan, many lack clear senior ownership for cybersecurity, and some do not have a dedicated CISO. Nearly a third also either lack cyber insurance or are unsure whether they are covered. The findings warned that attacks on manufacturers can quickly escalate from IT disruption to operational and financial damage, including reduced production capacity, delayed operations, shortages of components or materials, and missed customer deliveries. Make UK and Converged Solutions Group urged firms to raise cybersecurity to board level, strengthen supplier assurance, improve cyber hygiene, test recovery plans, and review insurance coverage, citing the **Jaguar Land Rover** attack as an example of how a single incident can trigger production stoppages and downstream effects across thousands of organizations.
Aug 11, 2026
Jaguar Land Rover (JLR) suffered a major cyberattack that resulted in the shutdown of its manufacturing operations for over a month, causing significant disruption across its supply chain and dealership network. The incident, which began in late August 2025, affected JLR’s IT systems and halted production at key plants in Solihull, Halewood, and Wolverhampton. More than 5,000 organizations in the UK were impacted, including suppliers and downstream businesses, as orders were canceled or delayed and dealer systems went offline. The Cyber Monitoring Centre (CMC), a nonprofit specializing in cyber incident analysis, estimated the economic impact at £1.9 billion ($2.5 billion), making it the most economically damaging cyber event in UK history. The CMC classified the event as a "Category 3 systemic event," indicating a severe but not the highest level of national impact. The financial estimate was based on a modeled range of £1.6 billion to £2.1 billion and only considered the UK, suggesting the global impact could be even greater. The disruption to JLR’s operations threatened the viability of businesses in its supply chain, putting thousands of jobs at risk and prompting calls for government intervention. In response, the UK government provided emergency financial support amounting to £1.5 billion to help JLR recover and stabilize its operations, although the CMC noted that the full cost to taxpayers might not materialize if the support is not fully utilized. JLR also launched a financing scheme to provide up-front cash to suppliers facing financial hardship due to the shutdown. The incident highlighted the systemic risk posed by cyberattacks to critical manufacturing sectors and the broader economy, with experts warning that cyber resilience is now a matter of national security. The event underscored the interconnectedness of modern supply chains and the cascading effects a single cyber incident can have across multiple industries. The CMC’s analysis emphasized the need for organizations to strengthen their cyber defenses to prevent similar large-scale disruptions in the future. The government’s intervention in this case could set a precedent for future responses to major cyber incidents affecting national infrastructure. The attack’s impact on JLR, which accounts for roughly 4% of all British goods exports, demonstrates the potential for cyber threats to undermine key economic sectors. The event has sparked debate about the adequacy of current cyber insurance and risk management practices in the face of systemic cyber threats. Industry leaders and policymakers are now reassessing strategies to bolster cyber resilience and protect critical supply chains from future attacks. The JLR cyberattack serves as a stark warning of the far-reaching consequences of cyber incidents on both organizational and national levels.
Jun 29, 2026
Jaguar Land Rover (JLR), one of the United Kingdom's most significant automotive manufacturers, experienced a severe operational disruption after a major cyberattack forced the company to shut down its systems on September 1, 2025. The attack led to the suspension of manufacturing activities at JLR's main production plants in the UK, as well as assembly lines in Slovakia, Brazil, and India. For over a month, the company was unable to produce vehicles or book sales, resulting in substantial financial losses estimated at £5-10 million ($6-13 million) per day. The cumulative impact of the downtime could reach £2.2 billion ($2.9 billion) in lost revenue and £150 million ($202 million) in lost profit. The Wolverhampton engine factory is the first site scheduled to resume operations, with Solihull and Halewood plants expected to follow in a phased approach. The restart process is anticipated to take several weeks before all facilities return to normal production levels. The disruption also had a cascading effect on JLR's extensive supply chain, with reports of job losses and financial strain among suppliers. In response to the crisis, the UK government provided a £1.5 billion ($2 billion) loan guarantee to help stabilize the company and protect jobs across the supply chain. However, industry groups such as the Confederation of British Metalforming have raised concerns that the financial aid has not yet reached suppliers beyond JLR's first-tier contractors, potentially leaving smaller businesses vulnerable. The Unite workers' union and other stakeholders welcomed the government intervention but cautioned that the support may not be sufficient for a full recovery, especially for smaller suppliers. The cyberattack is considered one of the most severe crises in JLR's history, surpassing previous challenges such as the global financial crisis, the COVID-19 pandemic, and the semiconductor shortage. The company and its workforce are now focused on restoring operations and mitigating the long-term economic impact of the incident. The phased resumption of manufacturing is expected to gradually restore activity throughout JLR's network, but the full financial and operational recovery may take considerable time. The incident underscores the vulnerability of critical manufacturing infrastructure to cyber threats and the far-reaching consequences such attacks can have on national economies and employment. JLR's experience highlights the importance of robust cybersecurity measures and contingency planning for large-scale industrial organizations. The company's recovery efforts are being closely monitored by industry observers, government officials, and the broader business community. The event has prompted renewed discussions about supply chain resilience and the need for coordinated responses to cyber incidents affecting critical sectors.
Jun 29, 2026