Log in Request a demo

Significant cyber incident

Jaguar Land Rover cyber attack

On 2 September 2025 Jaguar Land Rover (JLR) said a cyber incident had hit it, and it shut down its own systems.

In short

On 2 September 2025 Jaguar Land Rover (JLR) said a cyber incident had hit it, and it shut down its own systems. Car production and retail were severely disrupted, and manufacturing restarted in phases from 8 October 2025. The UK Government backed a loan guarantee of up to 1.5 billion pounds for the supply chain. One IT incident stopped a global manufacturer and put its suppliers' cash at risk. The public sources do not say how the attackers got in.

Last updated 9 October 2026

What happened

JLR told the public on 2 September 2025 that it had been hit by a cyber incident. It shut down its systems on purpose to limit the damage, and said its retail and production were severely disrupted. At that time it said it had no evidence that customer data had been stolen.

Production stayed paused through September. Government said the incident hit JLR and its wider supply chain. JLR restarted manufacturing in phases from 8 October 2025, and said production was back at normal levels by 14 November 2025.

The sources opened for this page do not describe how the attackers got in, and no source opened names an attacker.

Timeline

  1. 2 September 2025

    JLR says it has been hit by a cyber incident, has shut down its systems and that production and retail are severely disrupted.

  2. 5 September 2025

    The NCSC says it is working with JLR to provide support.

  3. 19 September 2025

    The Department for Business and Trade and the SMMT hold a supplier meeting; a joint statement says the incident has a significant impact on JLR and the supply chain.

  4. 22 September 2025

    JLR signs a 2 billion pound bridge facility.

  5. 23 September 2025

    The Business Secretary and Industry Minister meet JLR's CEO at Gaydon and visit the supplier Webasto.

  6. 28 September 2025

    The UK Government announces a loan guarantee expected to unlock up to 1.5 billion pounds for JLR's supply chain.

  7. 7 October 2025

    JLR announces the phased restart and a new supplier financing scheme; it reports Q2 volumes.

  8. 8 October 2025

    Manufacturing restarts at the engine and battery sites in the West Midlands.

  9. 14 November 2025

    JLR reports Q2 results and says production has returned to normal levels.

  10. 5 February 2026

    JLR reports Q3 results, still affected by the incident.

How the attack worked

What the sources say

JLR’s own statement says it was “impacted by a cyber incident” and that it shut down its systems itself. It said it was restarting its global applications in a controlled way.

What the sources do not say

None of the public pages opened for this entry describe how the attackers entered, what tools they used, or whether data was taken. JLR’s first statement said there was no evidence of stolen customer data at that stage. No technique is mapped here, because no opened source states one.

Why the shutdown mattered

JLR said it prioritized client, retailer and supplier systems in its recovery, and restarted its wholesale systems and its Global Parts Logistics Center. This shows how many business functions depended on the affected IT.

Who says who was behind it

No public attribution. None of the sources opened (JLR, UK Government, NCSC) names an attacker or a method.

Impact

Production: JLR said production was paused from the start of September and restarted in phases from 8 October 2025. It said production returned to normal levels by 14 November 2025.

Sales: JLR reported Q2 FY26 wholesales of 66,165 units, down 24.2 percent, and Q2 revenue of 4.9 billion pounds, down 24 percent. Q3 revenue was 4.5 billion pounds, down 39 percent. JLR said other factors also played a part, such as the wind down of older Jaguar models and US tariffs.

Costs: JLR reported exceptional items of 238 million pounds in Q2, of which 196 million pounds related to the cyber incident. Q2 loss before tax and exceptional items was 485 million pounds, and the loss after tax was 559 million pounds.

Supply chain: Government said the supply chain employs around 120,000 people and was greatly impacted by the shutdown. JLR set up a supplier help desk, manual payments and a finance scheme.

Data: JLR's first statement said there was no evidence at that stage that customer data had been stolen. No later statement on data was opened.

Outlook: JLR revised its FY26 guidance to an EBIT margin of 0 to 2 percent and a free cash outflow of 2.2 to 2.5 billion pounds.

Government and regulator response

  • 2 September 2025: JLR shut down its systems and began a controlled restart of its global applications.
  • 5 September 2025: the NCSC said it was working with JLR to provide support.
  • 19 September 2025: the Department for Business and Trade and the SMMT held a supplier meeting and said government cyber experts were in contact with JLR.
  • 22 September 2025: JLR signed a 2 billion pound bridge facility.
  • 23 September 2025: ministers visited JLR at Gaydon and the supplier Webasto. Government said it was in daily contact with JLR and cyber experts.
  • 28 September 2025: Government announced a guarantee expected to unlock up to 1.5 billion pounds from a commercial bank, backed by UK Export Finance and repaid over five years.
  • 7 October 2025: JLR announced the phased restart and a supplier finance scheme that pays suppliers up to 120 days faster. JLR said it would reimburse suppliers’ financing costs.
  • 14 November 2025: JLR said it had secured 3.5 billion pounds of extra liquidity backstop facilities and that production was back at normal levels.
  • JLR’s annual report says it continues to invest in strengthening its IT systems.

Lessons

  1. Plan for a long outage

    JLR's production was paused from the start of September and restarted in phases from 8 October 2025. Recovery plans should assume weeks, not days.

  2. Shutting down is a real option

    JLR shut its own systems down on purpose. Decide in advance who can make that call and what it stops.

  3. Suppliers carry the cash risk

    Government said the supply chain was greatly impacted. JLR set up a help desk, manual payments and a faster payment scheme.

  4. Know your recovery order

    JLR said it prioritized client, retailer and supplier systems. Agree the order for your own business before you need it.

  5. Cyber events become finance events

    JLR reported 196 million pounds of cyber related exceptional costs in one quarter and secured extra liquidity. Boards should link cyber plans to cash plans.

  6. Expect a long tail after restart

    Production was back to normal by mid November, but JLR said Q3 volumes were still hit by the time taken to distribute vehicles.

What to check in your own organization

  1. Manual operations

    Can your plants, orders and payments run by hand for several weeks if IT is shut down? Test it.

  2. Shutdown decision

    Who may order a full shutdown, and do they know which systems feed production and retail?

  3. Restart order

    Do you have a written order for restoring systems, including customer, dealer and supplier systems?

  4. Supplier payments

    Can you still pay your suppliers if the payment system is offline? Is there a manual route and a help desk?

  5. Supplier concentration

    Which suppliers would stop work within days if you stopped paying them or ordering?

  6. Liquidity

    Could you fund a month or more of lost sales? Do you know your emergency credit options?

  7. Contacts

    Do you know how to reach the NCSC or your national cyber agency, and who speaks to them?

Questions

When did the JLR cyber attack happen?

JLR announced the cyber incident on 2 September 2025.

Was customer data stolen?

JLR's first statement said there was no evidence at that stage that any customer data had been stolen. No later statement on this was opened for this entry.

When did production restart?

JLR said phased manufacturing restart began on 8 October 2025, and production returned to normal levels by mid November 2025.

Who was behind it?

No public attribution. None of the sources opened names an attacker.

What did the UK Government do?

On 28 September 2025 it announced a loan guarantee expected to unlock up to 1.5 billion pounds for JLR's supply chain. The NCSC said it was supporting JLR.

How much did it cost JLR?

JLR reported 196 million pounds of cyber related exceptional costs in the quarter to 30 September 2025. Lost sales and other factors are reported separately in its results.

In our research

  1. JLR cyber attack: what security buyers should ask October 2026
  2. UK retail attacks 2025: lessons for retailers October 2026
  3. Check-in outage: one supplier, many airports October 2026
  4. Securing the Supply Chain: Cybersecurity Best Practices for Manufacturers June 2024
  5. Comparing Cyber Security Attacks in Q3 – Q4 of 2022 for the Manufacturing Sector January 2023
  6. Manufacturing Industry

Sources

  1. Statement on Cyber Incident JLR Media Newsroom
  2. NCSC statement: Incident impacting Jaguar Land Rover National Cyber Security Centre
  3. Joint statement on government-industry supplier meeting regarding Jaguar Land Rover cyber incident Department for Business and Trade, GOV.UK
  4. Ministers meet JLR bosses and supply chain companies to help secure future of car industry Department for Business and Trade, GOV.UK
  5. Government backs Jaguar Land Rover with 1.5 billion pound loan guarantee Department for Business and Trade, UK Export Finance and HM Treasury, GOV.UK
  6. JLR restarts manufacturing and introduces new financing solution to pay JLR suppliers early JLR
  7. JLR volumes down in challenging quarter JLR Media Newsroom
  8. JLR performance impacted in challenging quarter JLR Media Newsroom
  9. JLR Q3 performance impacted by previously indicated challenges JLR
  10. Annual Report 2026 JLR
  11. NCSC Annual Review 2025 National Cyber Security Centre

Browse the threat library

Keep exploring

Knowledge Hub