Jaguar Land Rover extends shutdown again following cyberattack

Jaguar Land Rover (JLR) announced on Tuesday that its global operations will remain shuttered until at least next month in the latest delay to hit the manufacturer as it continues to deal with a cyberattack.

The company — one of Britain’s most significant industrial producers, accounting for roughly 4% of all goods exports last year — has made no cars or parts at all since the beginning of September, with many staff being told not to turn up for work.

A spokesperson said JLR was confirming another extension to this shutdown “to give clarity for the coming week as we build the timeline for the phased restart of our operations and continue our investigation.”

“Our teams continue to work around the clock alongside cybersecurity specialists, the NCSC and law enforcement to ensure we restart in a safe and secure manner.

“Our focus remains on supporting our customers, suppliers, colleagues, and our retailers who remain open,” they said.

Alongside its impact to the company, which is estimated to be losing £50-70 million ($67-94 million) per day, the standstill is having a dramatic impact on JLR’s supply-chain businesses in what one senior politician called “a cyber shockwave ripping through our industrial heartlands.”

More than 30,000 people are directly employed by JLR, while around 150,000 others are believed to be connected to it. Thousands of agency and temporary workers have been let go, while other employees have been told to stay at home on reduced pay.

The union Unite has called for a furlough scheme to support the impacted workers. A spokesperson for the Department of Business and Trade did not respond to a request for comment. The prime minister’s official spokesman previously stated there were “no discussions around taxpayers’ money” being used to help JLR suppliers.

Other measures which could be discussed might involve tax or business rate deferments, which would provide some gentle breathing space for businesses’ cash-flow challenges but would fall very short of government itself carrying the financial burden.

Britain’s business secretary, Peter Kyle, and its minister for industry, Chris McDonald, visited the company’s premises on Tuesday to hear from JLR itself and other businesses in its supply chain. In a statement, McDonald said the government wanted “to listen to workers and hear how we can support them and help get production back online.”

“We are acutely aware of the difficulties the stoppage is causing for those suppliers and their staff, many of whom are already taking a financial hit through no fault of their own – and we will do everything we can to reassure them that the government is on their side,” stated McDonald.

Shares in one of JLR’s suppliers, Autins, plummeted 55% last week as the business warned it was being significantly impacted by the shutdown. It is feared these kinds of disruptions to JLR’s supply chain will mean the incident has a greater economic impact than just the manufacturer’s direct contribution to exports.

Lucas Kello, the director of the University of Oxford’s Academic Centre of Excellence in Cyber Security Research, told Recorded Future News previously: “This is more than a company outage — it’s an economic security incident.”

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

SolarWinds Releases Hotfix for Critical CVE-2025-26399 Remote Code Execution Flaw

Next Post

Suspected cyberattack disrupts Circle K chain’s operations in Hong Kong

Related Posts

TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution

Cybersecurity researchers have disclosed details of a high-severity flaw impacting the popular async-tar Rust library and its forks, including tokio-tar, that could result in remote code execution under certain conditions. The vulnerability, tracked as CVE-2025-62518 (CVSS score: 8.1), has been codenamed TARmageddon by Edera, which discovered the issue in late August 2025. It impacts several
Read More

Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation

A set of nine malicious NuGet packages has been identified as capable of dropping time-delayed payloads to sabotage database operations and corrupt industrial control systems. According to software supply chain security company Socket, the packages were published in 2023 and 2024 by a user named "shanhai666" and are designed to run malicious code after specific trigger dates in August 2027 and
Read More

HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

Chinese-speaking users are the target of a search engine optimization (SEO) poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet FortiGuard Labs researcher Pei Han Liao said. "By using convincing language and small character
Read More