Jaguar Land Rover hit by cyberattack, halting global operations
Jaguar Land Rover is grappling with significant operational disruption after confirming it has suffered a cyberattack that has impacted both vehicle production and dealer operations across its extensive global network. The incident, which has affected facilities including the automaker's Solihull plant, left UK dealers unable to register new vehicles or supply essential parts, resulting in a slowdown for both customers and partners. The company has yet to disclose the specific nature of the attack or set a clear timeline for full restoration of services, and thus far, no ransomware group has claimed responsibility for the breach.
The attack underscores broader vulnerabilities inherent in modern manufacturing, where highly integrated digital systems underpin everything from assembly lines to sales and logistics. Ryan Sherstobitoff, Field Chief Threat Intelligence Officer at SecurityScorecard, explained, "This attack exposes the fragility of modern manufacturing environments, where tightly integrated systems support everything from factory output to retail logistics. Weekend timing further amplifies the impact, exploiting gaps in response readiness and delaying containment. Even without attribution, the incident reflects a growing trend of threat actors focusing on halting operations rather than stealing data."
At the core of these concerns is the rising trend of cybercriminals targeting industrial operations directly, seeking to disrupt rather than simply steal. Sherstobitoff suggests that manufacturers should treat both production and dealer systems as critical infrastructure. He advocates for comprehensive zero-trust access controls and real-time visibility across all global operations, stressing the need to extend protective measures to the wider ecosystem of third-party vendors and service providers. "As attackers shift focus toward operational sabotage, resilience must be built across the entire supply chain," he said.
The significance of the attack also lies in its timing and broader industry context. Just weeks earlier, high street retailer Marks & Spencer was able to resume online orders only after a six-week hiatus due to its own cyber incident. Mike Perez, Director at Ekco, commented, "They may still be taking deposits, but if production is frozen, the damage is likely already done. Halting these kinds of operations can cost hundreds of millions, and even bankrupt businesses. The hope is always that businesses act quickly and contain the impact, but response is one thing, preparation is another."
Perez stresses that the most severe damage in these scenarios often occurs before the breach is even detected. Effective cyber resilience, he argues, must be an ingrained organisational discipline rather than a reactive process. "Cyber resilience starts long before something goes wrong. You need people who are actively watching your systems – ideally a partner who's watching your systems around the clock, flagging issues early and acting fast to catch the early signs of a breach before it spreads. Retail and manufacturing are clearly top targets in 2025, and that's not changing anytime soon."
Recent high-profile attacks on a succession of global brands demonstrate a growing challenge for the UK business community. On this larger trend, Shankar Haridas, Head of UKI at ManageEngine, called the wave of security incidents a "matter of concern." He said, "The impact that this has on UK businesses especially is profound, and increasingly concerning. This brings to the forefront the relentless challenges organisations face in protecting their digital assets." Haridas noted that while companies continue investing in frontline defences, attackers are proving adept at exploiting weak points - particularly through supply chains and trusted third parties. The proliferation of AI, he added, has changed the threat landscape significantly, leading to a greater speed and scale of attacks.
Haridas argues that cyber security must transcend its traditional role as a protective layer or form of insurance. "No organisation can close every gap. That is why security can no longer be seen as an insurance policy – it must be embedded as a core strategic priority and a fundamental part of every organisation's toolkit."
The Jaguar Land Rover incident has exposed the growing complexity of defending against modern cyber threats in a digital-first, interconnected economy. As businesses face mounting pressure to guard against ever-more sophisticated attackers, attention is once again focused on the need for advanced, resilient security strategies - encompassing not only technology, but also people, processes and third-party risk.
