Russia-linked ransomware attack crippled Jaguar Land Rover production

A loose collective of cybercriminals took credit for the ransomware attack that froze Jaguar Land Rover and left a £1.9 billion hole in the U.K. economy. Investigators suspect Russian involvement. The breach knocked around 800 computer systems offline, halted production for more than a month and disrupted operations in the U.K., Brazil, India and Slovakia.

On September 5, 2025, the National Cyber Security Centre was working with Jaguar Land Rover after the incident. By September 19, the Department for Business and Trade and the Society of Motor Manufacturers and Traders were already meeting suppliers to assess the fallout, with about 200,000 jobs across JLR’s global supply chain left in limbo. JLR then extended its production pause through Wednesday, October 1, in a September 23 statement as it worked with cybersecurity specialists, the U.K. government and suppliers on a controlled phased restart.

On September 28, the government backed Jaguar Land Rover with a guarantee expected to unlock up to £1.5 billion to stabilize the supply chain, and on October 27 it instructed UK Export Finance to support a commercial loan guarantee. The Cyber Monitoring Centre classified the incident as a Category 3 systemic event on its five-point scale, estimating that more than 5,000 U.K. organizations were affected.

Jaguar Land Rover said the cyber incident cost it £196 million in direct exceptional items in the quarter to September 30, 2025, helping drive a £485 million pre-tax loss for the three months. The company said production had returned to normal levels after recovery efforts, but the timing worsened the commercial hit because the attack landed during the U.K. motor market’s “New Plate Day,” when dealers depend on a surge of registrations and deliveries. The Bank of England cited JLR-related disruption as one factor that dented U.K. GDP growth.