Production at Jaguar Land Rover’s UK plants has been “severely disrupted” by a cyberattack, the company confirmed.
According to BBC reports, JLR, which is owned by India’s Tata Motors, said it took immediate action to lessen the impact of the hack and is working quickly to restart operations. The firm’s retail business was also badly hit at a traditionally popular time for new car deliveries, though there is no evidence that any customer data has been stolen.
The attack comes after a recent spate of incidents across the UK retail sector, with Marks & Spencer, the Co-op, and Harrods among those worst affected. M&S had to halt online sales for about six weeks following a ransomware attack and warned the incident could cost the company around £300 million.
The attack was detected while in progress on Sunday, prompting the company to shut down its IT systems to minimise damage. It coincided with the release of the latest batch of new registration plates on Monday, 1 September.
Staff at the Halewood plant in Merseyside were reportedly told by email early on Monday not to come into work, while others were sent home. The attack also affected JLR’s main manufacturing plant in Solihull, with staff there also sent home.
It is not yet known who is responsible for the hack. The incident follows crippling attacks on prominent UK businesses including Marks & Spencer and the Co-op, where hackers sought to extort money.
While JLR’s statement did not mention a cyber-attack, a separate filing by its parent company, Tata Motors, to the Bombay Stock Exchange referred to an “IT security incidence” causing “global” issues. The National Crime Agency said it was “aware of an incident impacting Jaguar Land Rover and are working with partners to better understand its impact.”
The halt in production is a fresh blow to the firm, which recently revealed a slump in profits attributed to increasing costs caused by US tariffs. In 2023, JLR signed an £800 million deal with Tata Consultancy Services to provide cybersecurity and other IT services as part of its “accelerated digital transformation.”
Experts weigh in
Commenting on the news of the breach, Katie Barnett, Director of Cyber Security at Toro Solutions, said: “The recent Jaguar Land Rover (JLR) cyber incident underscores the critical importance of robust cyber security, especially when protecting the intricate supply chains that underpin modern manufacturing. Early detection of supply chain vulnerabilities is vital to minimising the impact of such breaches.”
Barnett went on to say that these events are highly disruptive and stressful for everyone involved in restoring systems and resuming operations. “They serve as a further reminder to reassess your IT resilience. While third-party vendors are essential to supply chain efficiency, it’s important to ask the following questions. Do they have the right security controls in place? Can you detect system infiltration early enough to contain the damage? Are your incident response plans ready to activate and restore business continuity at speed?”
She continued: “With its complex global networks, the automotive industry remains a high-value target for cyberattacks. Continued investment in third party risk and resilience audits, real-time monitoring, and rapid response strategies is essential to contain threats and recover swiftly, ensuring operational integrity and customer trust.”
JLR issued a statement to Press, saying: “We took immediate action to mitigate its impact by proactively shutting down our systems. We are now working at pace to restart our global applications in a controlled manner.”
It added: “At this stage there is no evidence any customer data has been stolen but our retail and production activities have been severely disrupted.”
