A five-week cyber-attack forced Jaguar Land Rover (JLR) to shut down its IT systems and halt global manufacturing operations, including three UK plants (Solihull, Wolverhampton, Halewood). The attack resulted in **zero vehicle production** in September, contributing to a **27% drop in UK car output**—the lowest since 1952. The incident is estimated to cost **£1.9 billion**, marking it as the **most economically damaging cyber event in UK history**. Over **5,000 businesses** were affected, with full recovery not expected until **January 2026**. UK vehicle exports also fell by **24.5%**, disrupting supply chains and delaying production for models like the Range Rover Sport and Jaguar I-Pace. The shutdown caused a **35.9% year-on-year decline** in total vehicle production, threatening the UK’s automotive sector resilience and government targets for domestic manufacturing growth.
Source: https://www.bbc.com/news/articles/cvgmp1prnv0o
TPRM report: https://www.rankiteo.com/company/jaguar-land-rover_1
"id": "jag0032200102425",
"linkid": "jaguar-land-rover_1",
"type": "Cyber Attack",
"date": "6/1952",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Automotive',
'location': ['Solihull, UK',
'Wolverhampton, UK',
'Halewood, UK'],
'name': 'Jaguar Land Rover (JLR)',
'size': 'Large (second-largest UK car producer by '
'volume)',
'type': 'Automotive Manufacturer'},
{'industry': 'Automotive',
'location': 'UK',
'name': 'UK Automotive Sector (SMMT members)',
'type': 'Industry Association'},
{'industry': 'Automotive Supply Chain',
'location': 'Global (primarily UK/EU/US)',
'name': '5,000 businesses (indirectly affected)',
'type': ['Suppliers', 'Partners', 'Dealerships']}],
'customer_advisories': ['Potential delivery delays for JLR vehicles (e.g., '
'Range Rover Sport, Jaguar I-Pace)'],
'description': 'A five-week cyber-attack on Jaguar Land Rover (JLR) forced '
'the shutdown of its IT systems and global manufacturing '
'operations, including three UK plants (Solihull, '
'Wolverhampton, Halewood). The incident halted production '
'entirely in September, contributing to a 27% drop in UK car '
'production—the lowest since 1952. The attack is estimated to '
'cost £1.9bn, affecting 5,000 businesses, with full recovery '
"expected by January 2026. JLR is the UK's second-largest car "
'producer after Nissan. Exports also slumped by 24.5%, '
'impacting key markets like the EU, US, and Japan.',
'impact': {'brand_reputation_impact': ['Potential long-term trust erosion',
'Short-term demand surge post-recovery '
'(per Autotrader data)'],
'downtime': '5 weeks (full shutdown in September 2024)',
'financial_loss': '£1.9bn (estimated)',
'operational_impact': ['100% halt in JLR vehicle production for '
'September',
'27% drop in UK car production (lowest '
'since 1952)',
'35.9% drop in total UK vehicle production '
'(year-over-year)',
'24.5% decline in UK vehicle exports',
'15.2% decline in year-to-date UK car/van '
'production (582,250 vehicles vs. 2024)'],
'systems_affected': ['IT systems',
'Global manufacturing operations (Solihull, '
'Wolverhampton, Halewood plants)']},
'initial_access_broker': {'high_value_targets': ['IT systems',
'Manufacturing operations']},
'investigation_status': 'Ongoing (recovery phase; full analysis pending)',
'lessons_learned': ['Supply chain resilience is critical for automotive '
'sector stability',
'Cyber incidents can have cascading economic impacts '
'beyond the targeted entity',
'Tax incentives (e.g., Employee Car Ownership Schemes) '
'are vital for industry competitiveness post-incident'],
'post_incident_analysis': {'corrective_actions': ['Phased recovery plan',
'Supply chain resilience '
'programs (proposed)']},
'recommendations': ['Bolster IT security for manufacturing systems',
'Implement rapid intervention programs for supply chain '
'resilience (per SMMT)',
'Retain tax breaks for Employee Car Ownership Schemes to '
'support recovery',
'Prepare for post-shutdown demand surges (per Autotrader '
'insights)'],
'references': [{'source': 'BBC News'},
{'source': 'Society of Motor Manufacturers and Traders (SMMT)'},
{'source': 'Cyber Monitoring Centre (CMC)'},
{'source': 'Autotrader'}],
'response': {'containment_measures': ['IT system shutdown',
'Global manufacturing halt'],
'incident_response_plan_activated': 'Yes (phased recovery '
'initiated)',
'recovery_measures': ['Expected full recovery by January 2026'],
'remediation_measures': ['Phased reopening of Solihull, '
'Wolverhampton, Halewood plants']},
'stakeholder_advisories': ['SMMT calls for government support to restore '
'competitiveness',
'JLR implementing phased production restart'],
'title': 'JLR Cyber-Attack Disrupts UK Car Production, Causing 70-Year Low in '
'September',
'type': ['Cyber-Attack', 'Operational Disruption', 'Supply Chain Impact']}