Jaguar Land Rover is resuming some production this week as it begins its phased restart of operations following a devastating cyber attack.
More than a month on from a cyber attack which knocked Jaguar Land Rover’s IT systems offline and forced a pause in production, JLR is gradually returning to operations.
Some sections of its manufacturing operations have resumed in the coming days, weeks and months, including at sites in the West Midlands and Wolverhampton.
Wolverhampton Plant Restarts First
Manufacturing first resumed at JLR’s Electric Propulsion Manufacturing Centre in Wolverhampton on Monday, 6 October.
A Jaguar Land Rover spokesperson said: “As the controlled, phased restart of our operations continues, we are taking further steps towards our recovery and the return to manufacture of our world-class vehicles.”
“We have informed colleagues, retailers and suppliers that some sections of our manufacturing operations will resume in the coming days.”
The company outlined that it was continuing to work alongside specialists, the National Cyber Security Centre and law enforcement.
This is being done to ensure the controlled, phased restart of its operations is done in a safe and secure manner.
Foundational Recovery Work
The spokesperson added: “We would like to thank everyone connected with JLR for their continued patience, understanding and support. We know there is much more to do but the foundational work of our recovery is firmly underway, and we will continue to provide updates as we progress.”
Last month, JLR announced that sections of its digital estate were back up and running, with the foundational work of the recovery programme firmly underway.
As part of this, it significantly increased its IT processing capacity for invoicing to clear the backlog of payments to suppliers.
Its Global Parts Logistics Centre, which supplies the parts distribution centres for its retailer partners, is also returning to normality.
JLR said this would allow retail partners to service vehicles and keep customers on the move during the ongoing production shutdown.
Financial Systems Back Online
It added: “The financial system we use to process the wholesales of vehicles has been brought back online and we are able to sell and register vehicles for our clients faster, delivering important cash flow.”
The attack, which began on 31 August 2025, brought production to a complete halt across all facilities in the UK, China, Slovakia, India and Brazil.
The company had been producing around 1,000 cars a day, including 700 in the UK, before it was forced to shut down operations.
The shutdown has been estimated to have cost the company around £120 million.
Government Support Package
The Government has intervened by backing the brand with a loan guarantee, which is expected to unlock £1.5 billion in support.
The loan is from commercial banks including HSBC, MUFG and NatWest, which is backed by the Export Development Guarantee provided by the export credit agency, UK Export Finance. The loan will be repaid over five years.
Business and Trade Secretary Peter Kyle said: “This cyber attack was not only an assault on an iconic British brand, but on our world-leading automotive sector and the men and women whose livelihoods depend on it.
“Following our decisive action, this loan guarantee will help support the supply chain and protect skilled jobs in the West Midlands, Merseyside and throughout the UK.”
Chancellor’s Support
Similarly, Chancellor Rachel Reeves said the loan guarantee would protect thousands of jobs at Jaguar Land Rover, which she described as a “jewel in the crown of our economy.
This is the first time a UK company has received direct government financial support specifically due to a cyber attack.
Cyber Criminal Group Claims Responsibility
A group calling itself Scattered Lapsus$ Hunters on Telegram claimed responsibility for the attack, suggesting collaboration between Scattered Spider, Lapsus$ and ShinyHunters, three English-speaking cybercrime groups.
The same group has been linked to previous attacks on major UK retailers including Marks & Spencer and Co-op.
The attack forced JLR to proactively shut down its entire global IT network to prevent further damage.
Supply Chain Impact
The disruption has caused significant financial strain across JLR’s vast supply chain, which employs around 100,000 people in addition to the 30,000 who work directly for the firm.
Michael Beese, managing director at Walsall-based Genex UK, which produces metal components for JLR, said his 17-person team had been temporarily laid off without pay whilst production was halted.
There was only a finite element of cash available whilst production was stopped,” Beese told the BBC. “For the staff, it’s very concerning, worrying, stressful, and I think I’m sharing those same feelings as well.”
He added that commercial lending rates had made it difficult to keep the business afloat, with one loan offer carrying 16 per cent interest and requiring a 100 per cent personal guarantee.
Phased Recovery
It is expected to be several weeks before the production lines are running at full capacity, with other sites including Solihull and Halewood having a phased return in the coming weeks.
JLR has car plants in Solihull and Halewood, as well as the engine facility in Wolverhampton.
The carmaker, which is owned by India’s Tata Motors, has reported that some data may have been stolen or viewed in the attack, though it’s not yet known if that data relates to customers, Jaguar Land Rover itself, or its suppliers.
JLR has stated it will contact any customers who have been affected directly once its investigation is complete.
Follow for more updates on Britannia Daily
Image Credit:
Duckworth Jaguar and Land Rover dealership — photo by Hugh Venables, licensed under CC BY-SA 2.0
