Quick answer: At the end of August 2025, a cyberattack forced Jaguar Land Rover to shut down its IT systems and stop car production at its factories, including Solihull and Halewood in the UK. The shutdown lasted for weeks and hit thousands of workers at suppliers. A criminal group calling itself Scattered Lapsus$ Hunters claimed responsibility, and JLR later confirmed that some data was affected.
| Key facts | |
|---|---|
| Date | Attack began 31 August 2025; production paused from 1 September 2025 |
| Organization | Jaguar Land Rover (car manufacturer, owned by Tata Motors) |
| Type of attack | Cyberattack causing a production shutdown, with some data affected |
| Attacker | Claimed by Scattered Lapsus$ Hunters |
| Impact | Global production stopped for weeks; suppliers sent workers home; data affected |
| Response | JLR proactively shut down its IT systems to contain the attack |
Timeline
- 31 August 2025: The attack begins.
- 1 September 2025: JLR pauses production and proactively shuts down IT systems.
- September 2025: The shutdown is extended several times; suppliers tell thousands of workers to stay home.
- 23 September 2025: JLR says the production pause will continue until at least 1 October.
What happened
Jaguar Land Rover, the UK’s largest carmaker, detected a cyberattack at the end of August 2025 and decided to shut down its IT systems to contain it. Because modern car plants depend on IT for parts ordering, scheduling and logistics, production stopped at its factories, including Solihull and Halewood in the UK, with closures also reported in other countries.
A group calling itself Scattered Lapsus$ Hunters claimed responsibility. JLR initially said there was no evidence customer data was stolen, but later confirmed that the attack had also resulted in a data breach.
The impact on suppliers and the economy
The shutdown spread down the supply chain. Suppliers including Evtec, WHS Plastics, SurTec and OPmobility, which together employ more than 6,000 people in the UK, told workers to stay home. Estimates of JLR’s daily revenue losses ranged from £5 million to £10 million, making it one of the most disruptive cyberattacks on British industry.
Lessons for your organization
- Manufacturers should plan how to keep production running, or restart safely, when IT systems are down.
- Separate factory and operational technology networks from corporate IT where possible.
- Talk to key suppliers about how a long shutdown would affect them, and agree support plans.
- Practise the decision to shut systems down: it contains attacks but has a large cost.
- Review cyber insurance cover for business interruption, not only data breaches.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. See our guide to supply chain attack vectors. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
What happened to Jaguar Land Rover?
A cyberattack starting on 31 August 2025 forced JLR to shut down its IT systems and stop car production for weeks.
Who hacked Jaguar Land Rover?
A criminal group calling itself Scattered Lapsus$ Hunters claimed responsibility.
Was JLR customer data stolen?
JLR first said there was no evidence of data theft but later confirmed that the attack had resulted in a data breach.
