Cyberattack leaves Jaguar Land Rover short of £680 million

British car manufacturer Jaguar Land Rover reported being out of £680 million ($896 million) over the three months ending September, driven significantly by the direct impact of a cyberattack that stopped all of its vehicle production on top of the costs of responding to that attack.

The company, which announced on Friday that manufacturing had now returned to normal levels, told investors it had lost £485 million ($639 million) over the period  — a hit effectively driven by the production halt — down from a £398 million ($424 million) profit recorded in the same period the year prior.

On top of that loss, the company said it also suffered cyber-related exceptional costs of £196 million ($258 million) — the additional expenditure of responding to the attack itself, not just the impact on operations — alongside additional losses due to a cost-saving redundancy scheme planned back in June.

Adrian Mardell, JLR’s outgoing chief executive — who had announced his plans to step down before the cyberattack — blamed the company’s performance on “significant challenges, including a cyber incident that stopped our vehicle production in September and the impact of US tariffs.”

Mardell said JLR’s response “prioritised client, retailer and supplier systems” and added the “speed of recovery is testament to the resilience and hard work of our colleagues.”

“I am extremely grateful to all our people who have shown enormous commitment during this difficult time, and I want to thank our clients, retailers, suppliers and everyone in the communities connected with JLR, for their support through this disruption,” added Mardell.

The impact on JLR, one of the British economy’s largest manufacturers, extended to a large number of other companies in its supply chain. One senior British politician called it “a cyber shockwave ripping through our industrial heartlands,” with potentially thousands of jobs put at risk. The British government ultimately intervened to secure a loan JLR said would be used to help support those suppliers.

A monitoring group estimated the shutdown would cost the British economy £1.9 billion ($2.5 billion) in total, with impacts felt across more than 5,000 other organizations from JLR’s own multi-tier manufacturing supply chain through to downstream entities such as dealerships.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

⚡ Weekly Recap: Fortinet Exploited, China’s AI Hacks, PhaaS Empire Falls & More

Next Post

New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT

Related Posts

Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats

An Iran-nexus group has been linked to a "coordinated" and "multi-wave" spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world. The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to broader offensive cyber activity undertaken by a group known as Homeland Justice. "Emails were sent to
Read More

Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity

Salesforce has warned of detected "unusual activity" related to Gainsight-published applications connected to the platform. "Our investigation indicates this activity may have enabled unauthorized access to certain customers’ Salesforce data through the app's connection," the company said in an advisory. The cloud services firm said it has taken the step of revoking all active access and refresh
Read More

New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT

Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for "AcridRain") Stealer, which was available under the
Read More