Jaguar Land Rover extends factory closures as cyber attack disrupts UK car maker's supply chain

Jaguar Land Rover extended its factory closures through at least Oct 1 as it works to recover from a cyber attack that crippled its IT systems and threatened production. The pause comes as the company, the United Kingdoms largest carmaker, warns of knock-on effects for suppliers and the broader auto supply chain.

The disruption began with the attack detected Aug 31, prompting a halt to production and creating registration delays for vehicles as dealers awaited processing under the new 75 plate. The company has said it is coordinating with cybersecurity specialists, industry regulators, and law enforcement to restart operations in a controlled, safe manner.

The company has stated there is no evidence yet that customer data was stolen, though hacker groups associated with the incident have claimed access to internal systems and data. In particular, the groups known as Scattered Spider and Shiny Hunters have discussed compromised data and have since described themselves as a single entity under the banner Scattered Lapsus Hunters. Security researchers note that such claims often surface in the wake of major cyber incidents, and governments emphasize that attribution and impact require thorough investigation.

The attack has drawn attention to cyber resilience in the UK automotive sector, with broader concerns about supply chain stability as manufacturers rely on an interconnected network of suppliers. JLR has cautioned that the stoppage could reverberate beyond its plants, affecting component makers and logistics partners along the chain.

From Whitehall, the government said Business Secretary Peter Kyle would visit JLR to meet with firms in its supply chain and to listen to workers about the disruption. Industry Minister Chris McDonald said the aim was twofold: to help JLR restart production as quickly as possible and to safeguard the long term health of the supply chain. Officials emphasized that the government would support suppliers and workers who are bearing financial losses through no fault of their own.

A JLR spokesman reiterated that the pause provides clarity for planning the phased restart, as the company continues its investigation. The spokesperson said teams are working around the clock with cybersecurity specialists, the National Cyber Security Centre, and law enforcement to ensure a safe and secure restart, and that the focus remains on customers, suppliers, colleagues, and retailers who depend on the brand.

Unions representing workers have pressed for a furlough-style scheme to mitigate the financial impact of the shutdown, arguing that many employees are suffering through no fault of their own as production remains idle. The stoppage also adds pressure to supplier plants whose own operations may be scaled back or paused in response to reduced output from JLR.

This episode follows a wave of cyber incidents that have disrupted retail and manufacturing brands in the UK this year, including high-profile hacks at Marks & Spencer, the Co-operative Group, and Harrods. While authorities investigate the scope and methods of the breach, industry observers warn that cyber threats can quickly destabilize production lines and erode confidence in the market.

JLR has signaled its intent to restart in a controlled manner and to provide regular updates as the timeline becomes clearer. The company thanked customers, partners, and employees for their continued patience and support as it works to resolve the disruption and safeguard the integrity of its systems and data.

This is a developing story. More details on the timeline for production restart and the broader supply-chain impact are expected as investigations proceed and government and industry groups coordinate a response.