Read more about the Jaguar Land Rover cyber-attack:
The cyber-attack that hit Jaguar Land Rover (JLR) in August 2025 was the most economically damaging cyber event to hit the UK, according to an independent body.
The Cyber Monitoring Centre (CMC), a UK-based independent organization launched in February 2025 to measure the impact of cyber incidents, shared its conclusions on the carmaker’s hack in an October 22 report.
It estimated that the cyber-attack caused a UK financial impact of £1.9bn ($2.55bn) and affected over 5000 UK organizations.
The CMC added that this cost “could be higher if operational technology has been significantly impacted or there are unexpected delays in bringing production back to pre-event levels.”
JLR Hack: A “Category 3” Systemic Cyber Event
To make this cost estimation, the CMC considered the substantial disruption to JLR’s manufacturing, its multi-tier manufacturing supply chain and downstream organizations, including car dealerships.
The “vast majority of the financial impact” was due to the loss of manufacturing output at JLR and its suppliers, according to the CMC.
“The incident impacted JLR’s internal IT environment leading to an IT shutdown and a halt in global manufacturing operations, including its major UK plants at Solihull, Halewood and Wolverhampton. Production lines were halted for several weeks, dealer systems were intermittently unavailable and suppliers faced cancelled or delayed orders, with uncertainty about future order volumes,” the CMC outlined.
The CMC analysts use a range of six metrics, including business interruption losses, incident response, IT rebuild and recovery costs and supply chain business interruption costs to evaluate the total cost of a cyber incident.
They then estimate the number of people affected by the incident and categorize each incident based on its total cost and the total number of people affected.
The JLR hack was ranked as a Category 3 systemic event on the five-point CMC scale.
Experts Demand Stronger Government Cybersecurity Oversight
According to Jake Moore, a global cybersecurity advisor, at ESET, this cyber-attack illustrated that the supply chain has never been so vulnerable.
“The mega costly loss of the JLR hack and the widespread disruption across the large number of associated businesses just shows on a worldwide stage how a single incident can knock on through interconnected systems and impact greatly far beyond the original target,” he said.
Ilia Kolochenko, CEO at ImmuniWeb, believes that the total financial loss estimated by the CMC is likely far from the true overall cost of the cyber-attack on JLR.
“The estimated £1.9bn loss may be just a small fraction of the total financial loss, merely representing already incurred and now-foreseeable losses that can be quantified,” he said.
“For instance, possible theft of valuable JLR’s trade secrets and their subsequent exploitation by rival corporations in hostile nations states may cause significancy more losses in the long-term perspective, even culminating in bankruptcy of JLR amid the unfolding economic uncertainty and looming financial crisis.”
Kolochenko also highlighted that the combined cost of several cyber-attacks targeting the same country or industry may be superior that the sum of its parts, especially when these attacks benefit to other nation states.
“What is even more alarming here is a doom-like scenario, when a hostile nation state hackers attack simultaneously 20 or 30 British companies of a similar size and national importance as JLR, including providers of critical national infrastructure. This mean that the entire country may stay without internet or even water and electricity for some time, let alone a brutal crush of economy and possible collapse of the British stock market,” he added.
Kolochenko advocated for companies of national importance to be “proactively audited by governmental agencies, setting cybersecurity and data protection compliance bar much higher than imposed by, say, UK GDPR or even the upcoming Cyber Security and Resilience Bill.”
ESET’s Moore also emphasized the need for board members to “recognise cybersecurity as a strategic risk equal to financial or operational threats.”
Photo credits: Richard OD / Bk87 / Shutterstock.com
