Loading story…
Jaguar Land Rover (JLR) suffered a major ransomware attack attributed to the HellCat group, which began on August 31 and resulted in the shutdown of production lines at all of its factories worldwide. The attack crippled critical systems, including computer-aided design (CAD), engineering software, product life-cycle management, payments tracking, and customer car delivery platforms, severely impacting the company’s ability to operate. As a result, JLR halted all vehicle manufacturing, and the disruption extended to its extensive supply chain, affecting hundreds of small companies that provide parts and services. Many of these suppliers faced severe financial distress, with some on the brink of bankruptcy due to the sudden loss of business and cash flow. The economic impact of the attack was significant, with JLR reportedly losing an estimated £50 million per week and the broader supply chain, employing around 150,000 people across 700 British firms, also suffering. In response to the crisis, the UK government agreed to underwrite a £1.5 billion loan to JLR through the Export Development Guarantee (EDG) program, aiming to stabilize the company and protect jobs throughout the supply chain. The loan, issued by a commercial bank and guaranteed by the government, is intended to help JLR support its suppliers and maintain skilled employment in key regions such as the West Midlands and Merseyside. UK Business Secretary Peter Kyle and Chancellor Rachel Reeves both emphasized the importance of the loan in safeguarding the British automotive sector. The Unite union, representing thousands of workers at JLR and its suppliers, welcomed the government’s intervention as a crucial step. JLR began restoring some IT systems in late September, enabling partial resumption of payment processing to suppliers, but full production was not expected to resume until at least October 1. The company’s lack of cyber insurance reportedly exacerbated the financial fallout. The attack not only disrupted JLR’s internal operations but also created significant challenges for retailers and parts ordering, further amplifying the economic consequences. The incident highlighted the vulnerability of complex manufacturing supply chains to cyber threats and underscored the need for robust cybersecurity and contingency planning. The UK government’s swift action to guarantee the loan was seen as essential to preventing further economic damage and supporting the recovery of both JLR and its network of suppliers. The event has raised concerns about the resilience of critical industries to ransomware attacks and the broader implications for national economic stability. JLR’s experience serves as a stark reminder of the far-reaching impact a single cyber incident can have on a major manufacturer and its ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Reporting said JLR was preparing a phased restart of affected production lines after the cyberattack. The restart was reportedly scheduled to begin on 2025-10-06.
In late September 2025, the UK government announced it would guarantee a £1.5 billion commercial loan for Jaguar Land Rover through UK Export Finance's Export Development Guarantee. Officials said the measure was intended to stabilize JLR's cash reserves, protect jobs, and limit wider supply-chain and economic disruption caused by the cyberattack.
Following the intrusion, a group calling itself "Scattered Lapsus$ Hunters" claimed responsibility, with reporting linking it to the broader Scattered Spider ecosystem. Security researchers also reported that actors including "Rey" and "APTS" leaked large volumes of JLR data on criminal forums, and initial access may have involved stolen Jira credentials obtained via infostealer malware.
Jaguar Land Rover detected a cyberattack on 2025-09-01. The incident disrupted operations and triggered shutdowns of production lines across the UK, Slovakia, Brazil, and India.
11 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcego.theregister.com
Open sourcebankinfosecurity.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcenews.risky.biz
Open sourceautocar.co.uk
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jaguar Land Rover (JLR), one of the United Kingdom's most prominent car manufacturers, suffered a significant cyberattack that brought its production lines to a halt across multiple sites, including Solihull, Wolverhampton, and Halewood. The attack, attributed to a group known as Scattered Lapsus$ Hunters, effectively took control of JLR’s manufacturing operations, resulting in a complete production stoppage for nearly a month. This disruption led to estimated financial losses of approximately £50 million per week, severely impacting not only JLR but also its extensive supply chain, which was pushed to the brink of bankruptcy. The scale and duration of the attack highlighted critical vulnerabilities in JLR’s cybersecurity posture, raising questions about the adequacy of its cyber risk management and preparedness. In response to the escalating crisis and the potential for widespread economic fallout, the UK government intervened with an unprecedented £1.5 billion loan guarantee to support the company. This move was justified by officials as necessary to protect jobs and stabilize the broader manufacturing sector, given JLR’s role in supporting over 800,000 jobs nationwide. The government’s intervention marked the first time a UK company received such substantial financial support specifically due to a cyber incident, setting a new precedent in the intersection of national economic security and cybersecurity. The bailout sparked debate over whether such government action might inadvertently encourage lax cybersecurity practices among large firms, knowing that public funds could be used as a safety net. The incident also brought to light the broader issue of cyberattack frequency and severity affecting UK businesses, with many organizations facing similar threats due to weak security controls and insufficient investment in cyber defense. The JLR case underscored the potential for cyberattacks to cause not only direct financial losses but also systemic risks to national industries and employment. It prompted calls for stronger regulatory oversight and more robust cybersecurity requirements for critical sectors. The event also served as a wake-up call for other UK businesses to reassess their cyber resilience and incident response capabilities. The government’s decision was framed as a measure to protect livelihoods, but it also raised concerns about the long-term implications for public policy and corporate accountability. The attack and subsequent bailout have become a focal point for discussions on the true extent of cyber threats facing UK businesses and the adequacy of current defenses. The situation has led to increased scrutiny of both private sector cybersecurity practices and the role of government in mitigating the fallout from major cyber incidents. As the dust settles, the JLR cyberattack is likely to influence future approaches to cyber risk management, public-private collaboration, and the allocation of responsibility for cybersecurity failures.
Jun 29, 2026
Jaguar Land Rover (JLR), the luxury automotive manufacturer and subsidiary of Tata Motors, experienced a significant operational outage due to a major cyberattack that forced the company to shut down its manufacturing systems. The incident led to a month-long disruption, with JLR initiating a controlled, phased restart of its manufacturing operations only after extensive downtime. Initially, the company stated that customer data did not appear to be compromised, but this position was revised a week later, indicating evolving understanding of the breach’s impact. Financially, the attack was devastating, with estimated losses ranging from $50 million to $70 million per week, and the total cost projected between $1.7 billion and $2.4 billion. The attack not only halted production but also highlighted the vulnerability of even large, resource-rich corporations to operationally crippling cyber incidents. Industry experts noted that this event went far beyond typical data theft, resulting in a complete operational outage that severely impacted JLR’s supply chain and business continuity. The British government responded by guaranteeing a £1.5 billion (approximately $2 billion) commercial bank loan to JLR, providing financial support as the company and its suppliers worked to recover from the disruption. This government-backed loan is structured so that JLR is responsible for repayment, but the lender is protected by the government guarantee in case of default. The incident has been cited as a case study in the high costs and business risks associated with ransomware and other forms of cyberattacks targeting critical manufacturing operations. Experts warn that automakers are increasingly attractive targets for ransomware gangs, as operational outages can pressure companies into paying ransoms quickly. Historical context shows that other major automakers, such as Honda, have also suffered significant outages due to cyberattacks, underscoring the sector’s susceptibility. The JLR attack has prompted renewed calls for robust incident response planning, improved cyber resilience, and greater investment in cybersecurity for operational technology environments. The event also demonstrates the potential for cyber incidents to have cascading effects across national economies, prompting government intervention to stabilize affected industries. As JLR resumes operations, the long-term impact on its reputation, supply chain relationships, and financial health remains under close scrutiny by industry observers and stakeholders.
Jun 29, 2026
Jaguar Land Rover (JLR) suffered a major cyberattack that resulted in the shutdown of its manufacturing operations for over a month, causing significant disruption across its supply chain and dealership network. The incident, which began in late August 2025, affected JLR’s IT systems and halted production at key plants in Solihull, Halewood, and Wolverhampton. More than 5,000 organizations in the UK were impacted, including suppliers and downstream businesses, as orders were canceled or delayed and dealer systems went offline. The Cyber Monitoring Centre (CMC), a nonprofit specializing in cyber incident analysis, estimated the economic impact at £1.9 billion ($2.5 billion), making it the most economically damaging cyber event in UK history. The CMC classified the event as a "Category 3 systemic event," indicating a severe but not the highest level of national impact. The financial estimate was based on a modeled range of £1.6 billion to £2.1 billion and only considered the UK, suggesting the global impact could be even greater. The disruption to JLR’s operations threatened the viability of businesses in its supply chain, putting thousands of jobs at risk and prompting calls for government intervention. In response, the UK government provided emergency financial support amounting to £1.5 billion to help JLR recover and stabilize its operations, although the CMC noted that the full cost to taxpayers might not materialize if the support is not fully utilized. JLR also launched a financing scheme to provide up-front cash to suppliers facing financial hardship due to the shutdown. The incident highlighted the systemic risk posed by cyberattacks to critical manufacturing sectors and the broader economy, with experts warning that cyber resilience is now a matter of national security. The event underscored the interconnectedness of modern supply chains and the cascading effects a single cyber incident can have across multiple industries. The CMC’s analysis emphasized the need for organizations to strengthen their cyber defenses to prevent similar large-scale disruptions in the future. The government’s intervention in this case could set a precedent for future responses to major cyber incidents affecting national infrastructure. The attack’s impact on JLR, which accounts for roughly 4% of all British goods exports, demonstrates the potential for cyber threats to undermine key economic sectors. The event has sparked debate about the adequacy of current cyber insurance and risk management practices in the face of systemic cyber threats. Industry leaders and policymakers are now reassessing strategies to bolster cyber resilience and protect critical supply chains from future attacks. The JLR cyberattack serves as a stark warning of the far-reaching consequences of cyber incidents on both organizational and national levels.
Jun 29, 2026