Jaguar Land Rover

Summary

Jaguar Land Rover experienced a ransomware attack that halted vehicle production and exposed employee and contractor data. The disruption led to multi‑billion‑pound financial losses, prompted regulatory scrutiny and the risk of legal action, and caused reputational harm to the parent group while the company provided credit monitoring and a helpline for affected individuals. Investigations traced the entry point to a third‑party IT vendor, and the incident prompted the vendor’s client to pilot enhanced AI‑driven cybersecurity measures across its services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In August 2025, Jaguar Land Rover experienced a ransomware attack that forced a halt in manufacturing operations at several of its facilities. The attack compromised personal data of current and former employees and contractors, as confirmed by JLR in its communication with Mint. Tokio Marine HCC International identified the incident as the most economically damaging cyber incident to hit the UK, citing a shutdown of vehicle production that resulted in a £1.9 billion financial loss. Mint reported that the prolonged breach was estimated to cause losses of up to $1 billion for JLR. The disruption also extended to vehicle repairs and maintenance across the affected sites.

JLR responded by arranging credit access and setting up a dedicated helpline for affected employees and vendors. The company stated it remained engaged with regulators and was reaching out to those impacted while an ongoing forensic investigation determined the scope of the data exposure. Tata Consultancy Services, which manages JLR’s back‑end IT under a five‑year, $1 billion IT transformation deal signed in September 2023, formed six specialised teams of about 150 professionals to pilot AI‑led cybersecurity protocols. The pilots include video‑based verification of critical IT support staff, the use of AI tools to monitor hacker movement inside systems, and the deployment of additional cybersecurity layers to strengthen network protection. Results of the pilots, once validated, are intended to be showcased to clients and integrated into their IT environments.

Senior Tata Group leadership, including TCS chief operating officer Aarthi Subramaniam, Tata Sons chief digital officer Aparna Ganesh, and Sudeep Mazumdar, vice‑president and manufacturing head for TCS UK and Ireland, reviewed the situation and provided weekly updates to Tata Sons chairman Natarajan Chandrasekaran. TCS chief executive P.B. Balaji disclosed that the company booked an exceptional loss of $150 million due to the production stoppage, noting that further recovery would depend on how quickly output could be ramped up. The JLR episode marked the third cyber incident involving a TCS client in a year, following attacks on British retailers Marks & Spencer and Co‑operative Group Ltd, and TCS management maintained that its own systems were not the entry point, with the breach traced to an IT vendor. As with the earlier Marks & Spencer incident, the attack originated through an IT vendor, underscoring the supply‑chain vector in the compromise.

Sources

Sources available to members: 2 sources.