Jaguar Land Rover Intrusion Halted Production and Cost £1.9 Billion

Attackers reached Jaguar Land Rover’s systems in late August 2025. Production stopped at the UK plants in Solihull, Halewood and Wolverhampton — roughly 1,000 vehicles a day — for a minimum of five weeks, and the global shutdown ran close to 40 days.

The Cyber Monitoring Centre has since assessed the cost at approximately £1.9 billion, around $2.5 billion. On that figure it is the costliest cyber incident recorded against a UK organisation.

Production also halted in Slovakia, China, India and Brazil. Those facilities were not attacked. They stopped because they are integrated through shared planning and digital engineering platforms, and a modern vehicle plant cannot build without them.

Manufacturing has spent three decades removing buffers. Parts arrive as needed, schedules are computed centrally, and configuration flows from engineering systems to the line continuously. Each of those decisions is individually correct and jointly produces an estate where an IT outage in one country idles a plant in another.

Stopping a vehicle plant takes hours. Restarting one takes weeks, in phases, because every system that feeds the line must be verified before it is trusted again — and because suppliers who stopped shipping have their own restart curves.

This is why a headline cost figure for a manufacturing incident bears little relation to the ransom, the remediation or the data. It is dominated by lost output and by supply-chain effects landing on companies that were never breached.

A £1.9 billion estimate is a modelled figure, and we treat it as one. Its value is not precision; it is that it gives a board an answer to the question of what the downside actually looks like, in the only unit that reliably moves a capital allocation decision.

For most manufacturers the honest position is that they do not know their own equivalent number, because nobody has been asked to calculate it.