Jaguar Land Rover production shutdown after cyber attack extended to 1 October

Britain's largest car manufacturer, Jaguar Land Rover (JLR), faces a prolonged shutdown of its global operations after the company announced an extension of the current closure, which began on 31 August, to at least 1 October.

The extension will cost JLR tens of millions of pounds a day in lost revenue, raise major concerns about companies and jobs in the supply chain, and raise further questions about the vulnerability of UK industry to cyber assaults.

A spokesperson said of the move: "We have made this decision to give clarity for the coming week as we build the timeline for the phased restart of our operations and continue our investigation.

Money latest: I was charged £885 for airport parking error

"Our teams continue to work around the clock alongside cybersecurity specialists, the NCSC and law enforcement to ensure we restart in a safe and secure manner.

"Our focus remains on supporting our customers, suppliers, colleagues, and our retailers who remain open. We fully recognise this is a difficult time for all connected with JLR and we thank everyone for their continued support and patience."

More than 33,000 people work directly for JLR in the UK, many of them employed on assembly lines in the West Midlands, the largest of which is in Solihull, and a plant at Halewood on Merseyside.

An estimated 200,000 more are employed by several hundred companies in the supply chain, who face a prolonged interruption to trade with what for many will be their largest client.

The "just-in-time" nature of automotive production means that many had little choice but to shut down immediately after JLR announced its closure, and no incentive to resume until it is clear when it will be back in production.

Industry sources estimate that around 25% of suppliers have already taken steps to pause production and lay off workers, many of them by "banking hours" they will have to work in future.

Read more:
More than a quarter of cars sold in August were electric vehicles
FCA considers compensation scheme for car finance scandal - raising payout hopes

Another quarter are expected to make decisions this week, following JLR's previous announcement that production would be paused until at least Wednesday.

JLR, which produces the Jaguar, Range Rover and Land Rover marques, has also been forced to halt production and assembly at facilities in China, Slovakia, India and Brazil after its IT systems were effectively disabled by the cyber attack.

JLR's Solihull plant has been running short shifts with skeleton staff, with some teams understood to be carrying out basic maintenance while the production lines stand idle, including painting floors.

Among workers who had finished a half-shift last Friday, there was resignation to the uncertainty. "We have been told not to talk about it, and even if we could, we don't know what's happening," said one.

Calls for support

The government has faced calls from unions to introduce a furlough-style scheme to protect jobs in the supply chain, but with JLR generating profits of £2.2bn last year, the company will face pressure to support its suppliers.

Industry body the Society of Motor Manufacturers and Traders said while government support should be the last resort, it should not be off the table.

"Whatever happens to JLR will reverberate through the supply chain," chief executive Mike Hawes told Sky News.

"There are a huge number of suppliers in the UK, a mixture of large multinationals, but also a lot of small and medium-sized enterprises, and those are the ones who are most at risk. Some of them, maybe up to a quarter, have already had to lay off people. There'll be another further 20-25% considering that in the next few days and weeks.

"It's a very high bar for the government to intervene, but without the supply chain, you don't have the major manufacturers and you don't have an industry."

What happened to the IT system?

JLR, owned by Indian conglomerate Tata, has provided no detail of the nature of the attack, but it is presumed to be a ransomware assault similar to that which debilitated Marks and Spencer and the Co-Op earlier this year.

As well as interrupting vehicle production, dealers have been unable to register vehicles or order spare parts, and even diagnostic software for analysing individual vehicles has been affected.

Last week, it said it was conducting a "forensic" investigation and considering how to stage the "controlled restart" of global production.

Speculation has centred on the vulnerability of IT support desks to surreptitious activity from hackers posing as employees to access passwords, as well as 'phishing' or other digital means of accessing systems.

In September 2023, JLR outsourced its IT and digital services to Tata Consultancy Services (TCS), also a Tata-owned company, intended, it said, to "transform, simplify, and help manage its digital estate, and build a new future-ready, strategic technology architecture".

Resilience risks

Three months earlier, TCS extended an existing agreement with M&S, saying it would "improve resilience and pace of innovation, and drive sustainable growth."

Officials from the National Cyber Security Centre are thought to be assisting JLR with their investigations, while officials and ministers from the Department for Business and International Trade have been kept informed of the situation.

Liam Byrne, a Birmingham MP and chair of the Business and Trade Select Committee, said the JLR closure raises concerns about the resilience of UK business.

"British business is now much more vulnerable for two reasons. One, many of these cyber threats have got bad states behind them. Russia, North Korea, Iran. These are serious players.

"Second, the attack surface that business is exposed to is now much bigger, because their digital operations are much bigger. They'll be global organisations. They might have their IT outsourced in another country. So the vulnerability is now much greater than in the past."

(c) Sky News 2025: Jaguar Land Rover production shutdown after cyber attack extended to 1 October