Jaguar Land Rover extends production shutdown after cyber attack

Jaguar Land Rover (JLR) said on Tuesday it will extend a production pause at its global factories until at least Sept. 24 as a forensic investigation continues into a cyber attack that forced the company to shut down online systems on Aug. 31.

The company informed staff, suppliers and partners that plants in the United Kingdom, Slovakia, India and Brazil will remain offline, meaning no vehicles will have been signed off the assembly line for almost four weeks. JLR said the decision was taken as it considered the different stages of a "controlled restart" of global operations and that the process "will take time." A company spokesman said JLR was "very sorry for the continued disruption" and would provide further updates as the investigation progressed.

JLR initially said there was no evidence customer data had been stolen, but last week updated its position, saying "some data has been affected" and that it was informing relevant regulators. The company declined to specify whether the affected data included customer information beyond its formal statement. Third-party cybersecurity specialists and law enforcement have been engaged to assist the probe, and the UK National Cyber Security Centre said it was working with JLR to provide support.

Security experts and industry figures warned of immediate and longer-term commercial effects. Birmingham University business economist David Bailey said the disruption could cost the car maker about £5 million a day and described the potential financial hit as "catastrophic." Dray Agha, senior manager of security operations at Huntress, said the incident highlighted "the critical vulnerability of modern manufacturing, where a single IT system attack can halt a multi-billion-pound physical production line." Agha added that restarting interdependent systems is a complex undertaking and that containment and recovery are crucial to a safe reboot.

Dealers and customers are already feeling the impact. JLR said online parts catalogues and diagnostic equipment used by dealers are inaccessible, preventing registration of new models and delaying repairs. Local suppliers have reported temporary layoffs as production stoppages ripple through supply chains, and some suppliers have raised concerns about the financial strain from an operation-wide shutdown.

A group identifying itself as "Scattered Lapsus$ Hunters" claimed responsibility for the breach. Security researchers who examined images posted by the hackers said the screenshots appeared to show internal troubleshooting instructions and system logs, suggesting access to internal information. The group has previously been linked to attacks on retailers earlier this year, including Marks & Spencer.

Industry commentators noted parallels with other recent attacks on UK companies. Retailers hit in the spring included M&S and the Co-op; the latter later confirmed that data on about 6.5 million members had been stolen. Those incidents have increased scrutiny of how businesses protect customer information and manage operational continuity after intrusions.

JLR said it was proceeding with a "forensic investigation" and would contact anyone it determined had been impacted. The company faces the immediate task of bringing online applications back in a controlled and safe manner while trying to reduce disruption during a peak sales period for new registrations. Suppliers and dealers have called for clarity on timelines and support, and some industry figures said the government might be asked to consider financial measures to cushion the impact on parts manufacturers and local economies reliant on JLR's operations.

The extension to Sept. 24 marks the latest phase of a shutdown that began at the end of August. Company officials have told partners that restoring services is expected to take "a matter of weeks rather than days," and said they would provide further updates as the situation evolved.