INCIDENT REPORT · CP-2025-015

Jaguar Land Rover cyberattack and production shutdown

L4 · CRITICALCONFIRMED

Jaguar Land Rover shut down its IT systems after a cyberattack, halting vehicle production at plants in the UK and abroad for over a month.

Incident ID: CP-2025-015
Disclosure date: 02 SEP 2025
Detection date: 31 AUG 2025
Affected countries: United Kingdom, Slovakia, Brazil, India
Plotted location: Coventry, United Kingdom (Affected organization headquarters (Whitley, Coventry))
Threat classification: Level 4 — CRITICAL
Classification rationale: Month-long shutdown of the UK's largest carmaker with government intervention to support the supply chain.
Attack type: Infrastructure Compromise
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Manufacturing, Logistics
Critical infrastructure: No
Organizations affected: Jaguar Land Rover, JLR supply chain
Operational consequences: Global production stopped from early September until a phased restart from 8 October 2025; the UK government provided a GBP 1.5 billion loan guarantee to protect the supply chain. JLR reported GBP 196 million of cyber-related exceptional costs in its July-September quarter.
Estimated financial impact: JLR Q2 FY26 results: GBP 196 million of cyber-related exceptional costs (excluding lost sales). No USD figure stated by the company.
Attribution (as stated): Claimed by a group calling itself 'Scattered Lapsus$ Hunters' (reported); no official attribution

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Jaguar Land Rover cyberattack and production shutdown

L4 · CRITICALCONFIRMED

Jaguar Land Rover shut down its IT systems after a cyberattack, halting vehicle production at plants in the UK and abroad for over a month.

Incident ID

CP-2025-015

Disclosure date

02 SEP 2025

Detection date

31 AUG 2025

Affected countries

United Kingdom, Slovakia, Brazil, India

Plotted location

Coventry, United Kingdom (Affected organization headquarters (Whitley, Coventry))

Threat classification

Level 4 — CRITICAL

Classification rationale

Month-long shutdown of the UK's largest carmaker with government intervention to support the supply chain.

Attack type

Infrastructure Compromise

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Manufacturing, Logistics

Critical infrastructure

Organizations affected

Jaguar Land Rover, JLR supply chain

Operational consequences

Global production stopped from early September until a phased restart from 8 October 2025; the UK government provided a GBP 1.5 billion loan guarantee to protect the supply chain. JLR reported GBP 196 million of cyber-related exceptional costs in its July-September quarter.

Estimated financial impact

JLR Q2 FY26 results: GBP 196 million of cyber-related exceptional costs (excluding lost sales). No USD figure stated by the company.

Attribution (as stated)

Claimed by a group calling itself 'Scattered Lapsus$ Hunters' (reported); no official attribution