JLR Cyberattack 2025: A Timeline of What We Know

In brief: The attack on Jaguar Land Rover is understood to have begun on or around 31 August 2025. JLR paused production on 1 September and publicly confirmed the incident on 2 September. A shutdown that lasted approximately five weeks followed, with JLR issuing several official updates through September and October confirming data was affected, regulators were notified, and a phased restart was underway. A cybercrime group claimed responsibility, but JLR has not officially attributed the attack to any party.

This article has been updated to reflect confirmed information following the incident. Last updated: October 2025. As with most cyber incidents, full technical details are rarely disclosed publicly. This timeline reflects confirmed reporting and official JLR statements.

The Confirmed Timeline, Based on JLR Statements and Published Reporting

The attack on Jaguar Land Rover is understood to have begun on or around 31 August 2025. Production was paused the following day, and the public confirmation came on 2 September. What followed was a shutdown of approximately five weeks across JLR's UK manufacturing sites, affecting production, parts logistics, and supplier payment systems across the business.

Below is the confirmed timeline. Where information comes from third-party reporting rather than official JLR statements, this is noted explicitly.

31 August 2025: The Attack Begins

According to subsequent reporting by BBC News and Wired, the cyber incident began on or around 31 August 2025. JLR paused production across its UK plants on 1 September as a direct response. The decision to shut down IT systems was taken as a containment measure.

2 September 2025: JLR Confirms the Incident Publicly

JLR publicly confirmed it had been hit by a cyber incident. In its initial statement, the company said there was no evidence at that point that customer data had been stolen, but warned that "retail and production activities have been severely disrupted."

The specific method of attack, the malware involved, and the responsible party were not confirmed by JLR in this statement.

9 September 2025: First Detailed Statement

JLR confirmed that some data had been affected and that relevant regulators had been informed, consistent with data protection obligations. The company stated it was working with law enforcement, external cybersecurity experts, and the UK's National Cyber Security Centre (NCSC).

Source: JLR Official Statement, 9 September 2025

The incident was also raised in UK Parliament on 10 September 2025, with MP Liam Byrne describing the attack as a "digital siege" and warning that supply chain workers were being laid off, with Unite advising affected workers to apply for Universal Credit.

16 September 2025: Production Pause Extended

JLR announced that its production pause would be extended until at least 24 September 2025, citing ongoing forensic investigation and the need for a controlled system restoration before manufacturing could safely resume.

Source: JLR Official Statement, 16 September 2025

On 19 September, the Department for Business and Trade and the Society of Motor Manufacturers and Traders issued a joint statement acknowledging the attack had "a significant impact on JLR and on the wider automotive supply chain."

23 September 2025: Second Extension Confirmed

A further extension was announced, pushing the production restart target to 1 October 2025 as the phased recovery plan continued to develop.

25 September 2025: Partial Systems Restored

JLR reported that parts of its digital infrastructure had been reactivated, specifically its invoicing systems and Global Parts Logistics Centre. This allowed the company to begin clearing a supplier payment backlog and resume parts flow. JLR described recovery as "firmly underway."

7 October 2025: Phased Production Restart

JLR confirmed the next phase of its operational restart. Production resumed first at the Electric Propulsion Manufacturing Centre (EPMC) and Battery Assembly Centre (BAC), with staff also returning to stamping and assembly facilities at Castle Bromwich, Halewood, and Solihull. A new supplier financing scheme was announced to help stabilise the supply chain.

Source: JLR Official Statement, 7 October 2025

Claimed Responsibility: What Has Been Reported

Shortly after the attack, a group calling itself Scattered Lapsus$ Hunters publicly claimed responsibility via Telegram. Reporting by Wired suggested the claim pointed to possible collaboration between three English-speaking cybercrime groups: Scattered Spider, Lapsus$, and ShinyHunters.

JLR has not officially attributed the attack to any party. These claims have not been independently verified by UK authorities in any public statement, and should be treated as reported rather than confirmed.

What Remains Unconfirmed (As of October 2025)

JLR has not disclosed the full extent of data affected, the precise financial cost to the business, or the identity of those responsible. The cost to the company has been estimated by third parties at approximately £50 million per week, and the total economic impact has been described in subsequent Reuters and BBC reporting as potentially reaching £1.9 billion, though these are analyst estimates rather than figures confirmed by JLR. The Bank of England noted in November 2025 that the cyberattack was a contributing factor to slower UK GDP growth. As with most incidents of this nature, full technical details are unlikely to be publicly disclosed.

Why This Goes Beyond JLR's Own Operations

Cyber incidents at major OEMs are rarely contained within the manufacturer itself. When JLR's systems went offline, the effects cascaded outward across the whole Land Rover ecosystem.

Parts databases, ordering portals, and VIN lookup tools that workshops rely on daily either went dark or became unreliable. Garages that would normally pull a part number in seconds were reverting to phone calls and manual cross-references. Smaller suppliers within JLR's network faced payment delays and operational uncertainty, with Unite reporting that supply chain workers were advised to apply for Universal Credit. And at the end of that chain, owners and mechanics were left waiting on parts with no clear timeline.

This is the reality of how deeply interconnected modern automotive supply chains are. When a centralised OEM system stumbles, the ripple reaches independent garages, parts specialists, and vehicle owners well before it reaches the headlines.

Suggested Sources

• JLR Media Newsroom: media.jaguarlandrover.com
• UK National Cyber Security Centre (NCSC): ncsc.gov.uk
• UK Parliament Hansard, 10 September 2025: hansard.parliament.uk
• Gov.uk joint statement, 19 September 2025: gov.uk

For analysis of how this disruption affected parts availability and independent workshops across Europe, see the companion piece: Impact on Land Rover parts supply and workshops →