Public cyber incident analysis · 2025
Jaguar Land Rover: when disruption spreads through the supply chain
The phased restart, reported costs and modelled economic impact describe different dimensions of the incident. Reading them together does not mean adding them together.
Analysis of a public incident, not a CyberUP client reference. Disclosures, documents and operational interpretation.
At a glance
Different figures. Different measures.
Figures and dates come from the cited sources. They are not results from a CyberUP exercise.
The documented record
Facts and scope.
Restarting means more than switching systems back on
The 7 October announcement set out a phased restart and measures to support supplier cash flow. On 14 November, JLR reported that production had returned to normal. That update separated £196 million in cyber-related costs from £42 million for a voluntary redundancy programme, and identified non-cyber factors affecting results. [1] [2]
Why the CMC estimate needs a date
CMC estimated a UK impact of £1.9 billion, within a £1.6–2.1 billion range, using information available on 17 October. Its model assumed a return to full production in January 2026; that assumption must be distinguished from JLR’s later November statement. Supply-chain effects reflect economic interdependencies, not proof of parallel compromises. The government loan guarantee is not a measure of loss. [3] [2] [4]
Key dates
The documented timeline.
Recovery includes the dependencies that make production possible
For an industrial exercise, we propose starting with the conditions that make production viable. The question is not simply which application restarts first, but which people, materials and partners must be ready for operations to be sustained. This broadens participation without treating every supplier as a technically compromised organisation.
The simulation can give Operations, Procurement, Finance and Cyber different information: system availability, outstanding orders, supplier capacity and liquidity constraints. The team must establish shared priorities and distinguish dependencies it controls from those that require external confirmation.
We also suggest exercising the language of estimates. A decision briefing should allow leadership to distinguish a recorded cost, a projection and a financing measure. Improvement is not a more dramatic headline figure, but more reliable decisions based on what each number actually means.
None of these proposals implies that CyberUP worked on this incident or would have prevented the disruption. Their value must be tested in the participant’s organisation, through observed decisions, cross-functional coordination and the exercise debrief.
From incident analysis to readiness
Three questions to test.
Exercise ideas for your organisation. They do not describe work carried out by CyberUP for the organisation discussed.
Who is missing from the restart discussion?
Alongside technical teams, identify those who understand production capacity, suppliers, materials and financial flows. Define the minimum information they need to share.
Can the supply chain support the plan?
Check that internal dates align with external confirmations. Record dependencies, alternatives and unresolved conditions.
Does every figure retain its meaning?
Distinguish reported costs, estimated impacts and liquidity measures in the briefing. Retain the source, period and modelling assumptions.
Source record
Sources and further reading.
Source dates and the period covered are distinct from this page’s source-review date. CyberUP interpretations are labelled as such. External sources do not imply endorsement or a commercial relationship.
- JLR · 7 October 2025
Restart manufacturing and new financing solution for suppliers (opens in a new tab)Primary company announcement. Phased restart from 8 October and measures to support supplier liquidity. - JLR · 14 November 2025
Performance impacted in challenging quarter (opens in a new tab)Primary company results. Q2 FY26 ended 30 September: £196 million in cyber-related costs; production reported back to normal on 14 November. - Cyber Monitoring Centre · 22 October 2025
Statement on the Jaguar Land Rover Cyber Incident (opens in a new tab)Independent model-based estimate. Information as of 17 October; estimated UK impact of £1.9 billion. The assumption of full production in January 2026 is distinct from JLR’s subsequent updates. - UK Government · 28 September 2025
Government backs Jaguar Land Rover with £1.5 billion loan guarantee (opens in a new tab)Primary government announcement. A guarantee supporting financing, not a loss or a direct transfer of the same amount.