Jaguar Land Rover's attack shows what happens when an organisation's core systems stop and nobody can say when they will return. The scale is different for a company of fifty people. The questions are the same.
What happened
Attackers targeted Jaguar Land Rover on 31 August 2025. On 1 September the company stopped production at its UK plants, and on 2 September it announced the attack. JLR first said there was no evidence that customer data had been stolen, then revised that position: "we now believe that some data has been affected."
Production stayed paused for five weeks. According to JLR's annual report, it restarted on 8 October and returned to normal levels in mid-November. On 29 September, the UK government announced a £1.5 billion loan guarantee to support the company and its supply chain.
A group calling itself Scattered Lapsus$ Hunters claimed responsibility and posted screenshots from a JLR system. JLR has not disclosed how the attackers got in.
The cost
JLR reported £196 million in direct cyber-related costs for the July to September quarter, not counting lost sales, and a pre-tax loss before exceptional items of £485 million. In October 2025, the independent Cyber Monitoring Centre estimated the cost to the UK economy at around £1.9 billion, affecting more than 5,000 UK organisations, and called it "the most economically damaging cyber event to hit the UK".
Much of that cost landed on suppliers that had done nothing wrong. JLR supports around 120,000 jobs in its supply chain, and it fast-tracked financing to give suppliers cash upfront.
Why it matters for your organisation
Most organisations are just as dependent on a few systems: email, file storage, finance and customer systems. If those stop, so does revenue, while deadlines and customer commitments do not move. And every organisation is part of other people's supply chains. Customers depend on it to keep their work moving and their information safe.
The JLR case also shows how early statements can change. "No evidence of data theft" became "some data has been affected" within weeks. Organisations need to be careful about what they tell customers and regulators in the first days.
What to do now
- Decide in advance who leads. Name an incident lead, a deputy and the people who can authorise shutting systems down or paying for outside help.
- Know your recovery time. Test whether you can restore email and documents from backups that attackers cannot reach, and how long it actually takes.
- Prepare to work without systems. Keep offline contact lists for staff, customers, insurers, lawyers and key suppliers.
- Draft communications early. Agree templates for customers, staff and regulators that say what you know without promising what you do not.
- Rehearse once a year. A two-hour tabletop exercise reveals most of the gaps in a plan.
How Blacknote helps
We write practical incident response plans, run tabletop exercises with your leadership, and stand by as your single point of contact when something happens, coordinating your IT provider, forensics partners and data protection lawyers.
Sources
- JLR Annual Report 2026
- Irish News (PA): Jaguar Land Rover plunges to loss after heavy cyber attack costs
- BleepingComputer: UK government backs JLR with £1.5 billion loan guarantee after cyberattack
- Computing: JLR attack most expensive in UK history
- Security Affairs: Cyberattack on Jaguar Land Rover inflicts loss on UK economy
- Security Affairs: Jaguar Land Rover extends production halt