A cyberattack froze Jaguar Land Rover's whole manufacturing estate for about five weeks

In late August 2025 Jaguar Land Rover, Britain's largest carmaker, was hit by a cyberattack that forced it to pause vehicle production across its UK plants from 1 September 2025. The company, which employs around 33,000 people, shut its Halewood, Solihull and Castle Bromwich factories in whole or in part while it worked to contain the intrusion.

The outage ran about five weeks. JLR's factories stayed closed into October, with production expected to restart on 1 October, and the company warned that recovery would take time. The ripple hit the whole sector: UK car production fell by more than a quarter in September compared with the same month a year earlier, a drop driven largely by JLR's shutdown.

Researchers told the BBC the disruption was one of the most economically damaging cyber events in UK history. TechCrunch reported that JLR later said data had been stolen in the attack; the intrusion was widely tagged as ransomware, though the company never confirmed the attack type or attributed it.

The attack exposed a single point of failure: a consolidated IT estate through which both manufacturing control and administrative systems ran. Because one intrusion could reach the systems that run the production line, a software incident became a physical one — Britain's largest carmaker simply stopped making cars for five weeks.