UK government to be guarantor for Jaguar Land Rover loan as it recovers from cyberattack

The British government announced it is underwriting a loan for auto manufacturer Jaguar Land Rover (JLR) as the company and its supply chain attempt to recover from the disruption caused by a cyberattack earlier this month.

JLR itself is responsible for repaying the £1.5 billion ($2 billion) five-year loan from an unnamed commercial bank, but the lender has received a guarantee that the British government would step in if JLR fails to repay it.

It is not known how much of a risk the lender attached to that outcome. In JLR’s annual results this year, the company reported generating £2.5 billion ($3.3 billion) in profits before tax and £29 billion ($38.9 billion) in revenue.

It is not known how significantly the disruption to production will impact JLR this year, although a widely reported estimate suggests it is costing the company about £50-70 million ($67-94 million) per day.

According to the government’s announcement, the loan will “bolster JLR’s cash reserves so it can support its supply chain which has been greatly impacted by the shutdown.”

JLR — one of Britain’s most significant industrial producers, accounting for roughly 4% of all goods exports last year — shut down all manufacturing at the beginning of this month due to the cyber incident. 

Lucas Kello, the director of the University of Oxford’s Academic Centre of Excellence in Cyber Security Research, described the attack as “more than a company outage — it’s an economic security incident,” when he spoke previously to Recorded Future News.

After several extensions to the shutdown, JLR announced on Monday it would begin resuming production in the “coming days” with a phased return of its impacted IT systems.

The pause has posed a significant business risk to its suppliers whose production depends on JLR as a customer, causing what one senior politician called “a cyber shockwave ripping through our industrial heartlands.”

The announcement to support this supply chain follows Britain’s business secretary, Peter Kyle, and its minister for industry, Chris McDonald, visiting the company’s premises last week to hear from JLR and affected suppliers.

Kyle stated on Sunday that the cyberattack “was not only an assault on an iconic British brand, but on our world-leading automotive sector and the men and women whose livelihoods depend on it,” and stressed the move would be protecting skilled jobs.

According to BBC News, JLR intends to use the funds to order parts from its supply-chain to help the cash flow of those businesses which were facing mounting levels of debt despite laying off staff and forcing others to take banked hours.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

Next Post

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

Related Posts

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe (aka APT36), a state-sponsored hacking group known to be active since at least 2013. It also builds upon a prior
Read More

CISA Warns of Two Malware Strains Exploiting Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday released details of two sets of malware that were discovered in an unnamed organization's network following the exploitation of security flaws in Ivanti Endpoint Manager Mobile (EPMM). "Each set contains loaders for malicious listeners that enable cyber threat actors to run arbitrary code on the compromised server,"
Read More

New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails

The threat actor linked to Operation ForumTroll has been attributed to a fresh set of phishing attacks targeting individuals within Russia, according to Kaspersky. The Russian cybersecurity vendor said it detected the new activity in October 2025. The origins of the threat actor are presently unknown. "While the spring cyberattacks focused on organizations, the fall campaign honed in on
Read More