Jaguar Land Rover extends production shutdown as forensic probe into cyber attack continues
Factories in the UK, Slovakia, India and Brazil remain offline until at least Sept. 24 after a late‑August breach; investigators say some data was affected and the NCSC is assisting.
Jaguar Land Rover said it will extend a global production shutdown for another week as a "forensic investigation" into a cyber attack that forced the company to take its online systems offline at the end of August continues.
The car maker notified staff, suppliers and partners that factories closed on Aug. 31 will not restart until at least Sept. 24, leaving plants in the United Kingdom, Slovakia, India and Brazil without a signed‑off vehicle for almost four weeks. The disruption has been estimated to be costing the company about £5 million per day in lost revenue.
In a statement, a Jaguar Land Rover spokesman said: "We have taken this decision as our forensic investigation of the cyber incident continues, and as we consider the different stages of the controlled restart of our global operations, which will take time. We are very sorry for the continued disruption this incident is causing and we will continue to update as the investigation progresses." The company previously told media there had initially been "no evidence any customer data has been stolen," but announced last week that "some data had been affected" and that it was informing relevant regulators.
Jaguar Land Rover has engaged third‑party cybersecurity specialists and law enforcement to determine the full scope of the intrusion. The National Cyber Security Centre said it is working with the company to "provide support" while investigators assess the consequences of the breach.
Dealers and service networks have reported operational impacts beyond halted production. Online catalogues for spare parts and diagnostic systems used by dealers are not accessible, delaying repairs for thousands of customers, and dealers have been unable to register new models during a traditionally busy sales month. Suppliers that provide parts to Jaguar Land Rover have said they are facing reduced work and some local companies have temporarily laid off staff in response to the near‑operation‑wide shutdown.
Security analysts and company officials have warned that restoring interconnected manufacturing and enterprise systems is complex and likely to take weeks rather than days. Dray Agha, senior manager of security operations at Huntress, said the incident "highlights the critical vulnerability of modern manufacturing, where a single IT system attack can halt a multi‑billion‑pound physical production line, directly impacting sales, especially during a key period like a new registration month." He added that while an immediate shutdown can limit damage, restarting affected systems is a "complex" operation that requires careful containment and recovery.
The incident follows claims by an English‑speaking group calling itself "Scattered Lapsus$ Hunters," who said they were responsible for the breach. The group, alleged to include teen members, previously claimed responsibility for a damaging attack on Marks & Spencer earlier in the year. Three days after the Jaguar Land Rover intrusion, the hacker account posted two images reportedly showing internal troubleshooting instructions and computer logs, which security experts said appeared to reflect access to information that should not have been publicly available.
Economists and industry commentators have warned of broader economic effects if the outage continues. David Bailey, professor of business economics at Birmingham University, said the disruption could cost the company a "catastrophic" £5 million a day and noted that the company directly employs about 11,000 people in the U.K., in addition to roles across its supplier network.
Jaguar Land Rover said it will contact any individuals directly if the investigation determines their data has been impacted. The company did not provide further detail on the nature of the data affected when pressed for clarification.
As investigators continue forensic analysis, the company faces operational, regulatory and reputational pressures. Officials and outside experts said the timeline for a controlled and safe return to full operations depends on the results of the forensic work, remediation of vulnerabilities, and validation that systems are secure before they are brought back online. Jaguar Land Rover said it will provide further updates as the investigation progresses.