Jaguar Land Rover Shows Cyberattacks Mean (Bad) Business

The month-long outage at Jaguar Land Rover appears to be ending, with the firm beginning a controlled, phased restart of manufacturing after a cyberattack disrupted operations. JLR said on 2 September 2025 that it had proactively shut down operations following a cyber incident, later revising its initial claim that customer data had not been stolen.

The disruption is estimated to have cost the company up to $50 million to $70 million in revenue each week, with total incident costs placed at between $1.7 billion and $2.4 billion. Threat researchers have linked the attack to a Telegram channel calling itself “Scattered Lapsus$ Hunters” and noted that the HELLCAT group leaked 700 internal documents in March, a disclosure Cyfirma described as concerning due to exposed development logs and employee data.

JLR extended its production pause to 1 October 2025, with plants typically producing around 1,000 vehicles daily; the company continues to work with third parties and the UK government’s NCSC to ensure a safe restart. According to Cyfirma, the incident illustrates how attackers can target both IT and OT systems, emphasising the need for stricter network segmentation and stronger resilience against future breaches.