Desk live·
ForensicPost
Ransomware/Manufacturing/File 25-1008

Jaguar Land Rover Restarted Full Production Five Weeks After the Halt

Jaguar Land Rover restarted full production on 8 October 2025, five weeks after the halt. The restart date is where coverage ends and where the harder part begins.

Constructed geometry · not a chart of case data
JurisdictionUnited KingdomCoventrythe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetJaguar Land Rover
ActorScattered Lapsus$ Hunters
S. Rosler10 min readConfidence: medium2 sources reviewed

Jaguar Land Rover restored full production on 8 October 2025, following a phased restart through late September. Wholesale volumes for the affected period were reported down 43%.

The Line Running Again Is The Start Of The Work

Five weeks of unbuilt vehicles do not simply appear once the line moves. Orders were deferred or lost. Suppliers who cut their own output must be brought back up. Parts produced before the halt were sitting in the wrong places. Every scheduling assumption downstream was invalidated.

A stopped production system does not resume; it restarts from a different state, and the difference has to be worked out physically, vehicle by vehicle.

Which Is Why The Reported Cost Keeps Moving

This is not evasion by the company. Cyber incident costs genuinely arrive over quarters: recovery labour, expedited freight, supplier support, lost margin on deferred orders, and — for a manufacturer — the residual effect on a build schedule that takes months to normalise.

It is the reason the average-cost figures this desk criticised at 25-0808 and 25-0616 are so unstable. They are measured at a point in time chosen by the person measuring, and for an incident of this shape that choice determines the answer.

And Nobody Publishes The Recovery Curve

The corpus can say when production stopped and when it restarted, because both were announced. It cannot say when output returned to plan, when the supply chain normalised, or what the twelve-month total was, because no reporting regime asks and no company volunteers it.

Graded medium for that reason: the restart date is firm, and everything about the recovery beyond it is not established.

How we reported this

Compiled from company statements and public reporting, listed below. Recovery beyond the restart date is not established in the material we reviewed and we do not estimate it. Corrections: corrections@forensicpost.com.

Sources
  1. Car production at Jaguar Land Rover to restart after cyberattackForbes
  2. Jaguar Land Rover confirms major disruption and £196M cost from September cyberattackSecurity Affairs
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary