Desk live·
ForensicPost
Ransomware/Manufacturing/File 25-0902

Jaguar Land Rover Paused Global Production for Three Weeks, Booking £196 Million

Jaguar Land Rover paused production on 1 September 2025 after an intrusion detected on 31 August. Global output stopped for three weeks and the company booked £196 million against the quarter.

Constructed geometry · not a chart of case data
JurisdictionUnited KingdomCoventrythe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetJaguar Land Rover
ActorScattered Lapsus$ Hunters
D. Kennedy13 min readConfidence: high4 sources reviewed

Jaguar Land Rover suffered an intrusion beginning 31 August 2025 and paused production on 1 September. Manufacturing at its plants stopped entirely; staff were told to stay at home. By 22 September the lines had been down for three weeks, and full production did not restart until 8 October. The company confirmed a £196 million cost in the affected quarter.

A group calling itself Scattered Lapsus$ Hunters claimed responsibility. This desk records that as a claim.

Sequence as reportedCompany statements and contemporary reporting
TimeEventEvidence
31 Aug 2025Intrusion beginsCompany statement
01 Sep 2025Production pausedCompany statement
22 Sep 2025Three weeks of stoppage confirmedContemporary reporting
28 Sep 2025UK government guarantee announcedGovernment statement
08 Oct 2025Full production restartsCompany statement

Nothing Was Stolen That Anybody Has Quantified

This is the point the rest of this database has been building towards. No affected-individual count anchors this file. No notification volume, no records exposed, no credit monitoring offered.

What happened was that a manufacturer could not manufacture for five weeks. On the confidentiality-shaped metrics this industry actually collects, the most economically damaging incident of the year barely registers — which is the availability argument this desk filed at 26-0209, appearing at a scale that cannot be waved away.

Modern Manufacturing Has No Slack By Design

Just-in-time production is an achievement. Decades of engineering removed the buffer stock, the duplicate systems and the idle capacity that used to sit between a disruption and a stoppage, and the savings were real and were passed on.

The same removal means there is no longer anything between an IT outage and a stopped line. A vehicle assembly plant needs parts sequenced to the hour from hundreds of suppliers, and the sequencing is software. When the software stops, the line stops that day — not eventually.

This is the manual-fallback finding from 26-0727 and 26-0406 stated in its strongest form: JLR had no analogue mode to fall back to, because building a modern car does not have one.

The Cost Is Not The Company’s Cost

£196 million is what JLR booked. Estimates of the total damage to the UK economy run to £1.9 billion, because JLR employs around 34,000 people directly and supports roughly 120,000 through its supply chain.

Those suppliers did not choose JLR’s security posture, had no visibility into it and had no ability to influence it. They carried the consequence anyway — the concentration structure this database files constantly, running for once in the direction of operations rather than data.

How we reported this

Compiled from company statements and public reporting, listed below. The £196 million figure is the company’s own. The £1.9 billion economy-wide estimate is a third-party assessment with substantial uncertainty and is reported as such. Attribution is a claim by the named group and is not established. Corrections: corrections@forensicpost.com.

Sources
  1. Jaguar Land Rover confirms major disruption and £196M cost from September cyberattackSecurity Affairs
  2. Jaguar Land Rover cyberattack deepens, with prolonged production outage, supply chain falloutIndustrial Cyber
  3. Car production at Jaguar Land Rover to restart after cyberattackForbes
  4. JLR halts production after cyberattackCybernews
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary