Jaguar Land Rover reports cyberattack that severely disrupted production and sales operations
Learn More
Jaguar Land Rover (JLR) is reporting a significant cyber attack that has severely disrupted the luxury automaker's global production and retail operations, forcing the company to shut down critical systems as a protective measure.
The incident, which began over the weekend of September 1, 2025, has resulted in widespread operational disruption across JLR's manufacturing facilities and dealer networks.
The attack struck at a very unfortunate time for the UK automotive industry, coinciding with September 1st - traditionally one of the busiest days for new vehicle registrations in Britain due to the release of new license plate numbers. It's possible the attackers deliberately targeted JLR to maximize operational and reputational damage during a peak sales period.
On Monday, September 1st 2025 th UK dealerships were unable to register new vehicles or access parts supply systems.
The nature of the attack is not disclosed, but cybersecurity experts suspect this may be a ransomware incident based on the widespread nature of the operational disruption and the company's aggressive response of shutting down systems. Production lines halted at major manufacturing facilities including the Solihull plant in the West Midlands, where popular models like the Land Rover Discovery, Range Rover, and Range Rover Sport are manufactured. Workers at the Halewood production plant in Merseyside were sent emails early Monday morning instructing them not to report for work, with the shutdown expected to continue into Wednesday, September 3rd.
At this stage, JLR states there is no evidence that customer data has been compromised or stolen during the incident. The company acknowledges that the investigation is ongoing, and the full extent of any potential data exposure has not yet been determined.
Update - As of 10th of September 2025, Jaguar Land Rover confirmed that the cyber-attack impacted its data, that “some data” was taken in the incident and that it has informed the relevant regulators. The company refused did not provide details of which data was affected, or if customers’ or suppliers’ information was stolen. They claim they would be contacting anyone affected.
