Jaguar Land Rover warns that 'some data has been affected' after devastating cyber attack

Felix Reeves

By Felix Reeves


Published: 10/09/2025

- 11:28

Updated: 10/09/2025

- 15:08

The same group which took down M&S services for months has claimed responsibility for the JLR attack

Jaguar Land Rover has confirmed that some data may have been lost in a recent cyber attack that devastated the British manufacturer.

In a new statement, Jaguar Land Rover confirmed that it was continuing to work around the clock to restart global operations.


This follows a cyber attack at the start of the month which forced the company to pause its production and retail operations.

A spokesperson for Jaguar Land Rover announced that it was working with third-party cybersecurity specialists to ensure the company can return to normality.

Do you have a story you'd like to share? Get in touch by emailing motoring@gbnews.uk

JLR factory

Jaguar Land Rover has warned that some data may have been compromised in a recent cyber attack

|

JAGUAR LAND ROVER

However, the ongoing investigation has found that some data could have been compromised.

The spokesperson said: "We now believe that some data has been affected and we are informing the relevant regulators.

"Our forensic investigation continues at pace and we will contact anyone as appropriate if we find that their data has been impacted.

"We are very sorry for the continued disruption this incident is causing and we will continue to update as the investigation progresses."

READ MORE: Jaguar Land Rover forced to shut down systems with 'severe disruption' after 'cyber attack'

Jaguar Land Rover Halewood FactoryJaguar Land Rover said it was working to restore its systems as quickly as possible | JLR

Jaguar Land Rover confirmed that it would not be making further statements while the investigation into the nature, scope and extent of the affected data is ongoing.

Staff at Jaguar Land Rover's production facilities have been told to stay away from work since last week in the aftermath of the cyber attack.

JLR confirmed that it had shut down its IT systems in response to the cyber attack, which was first identified on August 31, with experts praising the brand for doing so before the hack was worsened.

However, workers on the production lines have not been given a firm date for when they can return. The attack has impacted its Halewood and Solihull car plants, in addition to its Wolverhampton engine factory.

Further disruption has been seen at JLR's factories in Slovakia, China and India, with parent company Tata Motors reporting a "cyber incident", but giving no further details.

LATEST DEVELOPMENTS:

Jaguar Land Rover's Halewood Plant

Staff at JLR's Halewood Plant were told to go home last week

|
PA

Former Land Rover chief engineer Dr Charles Tennant told the BBC that JLR could be losing "around £5million per day" in lost profits.

He added that the cyber attack came at the "worst possible time" since manufacturers see a spike in sales in March and September when new number plates are released.

The allure of "new reg day" has long buoyed the UK car market as drivers look to get their hands on the latest models and licence plates every six months.

An English-speaking collective has claimed responsibility for the cyber attack. They have posted screenshots that appear to show sensitive data from Jaguar Land Rover. They are also believed to be the group behind the Marks & Spencer hack that devastated the retailer for months.

Prime Minister Keir Starmer and Chancellor Rachel Reeves visited the Jaguar Land Rover factory in Solihull in AprilPrime Minister Keir Starmer and Chancellor Rachel Reeves visited the Jaguar Land Rover factory in Solihull in April | PA

Cybersecurity experts have commented on Jaguar Land Rover's response to the cyber attack, with many commending the brand for taking quick action once it detected an issue.

Cody Barrow, CEO of EclecticIQ, said the JLR attack showed how cybercrime was evolving into "strategic business warfare".

The former NSA employee claimed that it was not a "random strike", noting the proximity to the UK introduction of the new "75" number plate at the start of September.

Similarly, Mark Tibbs, a Partner within the Cyber Risk and Complex Investigations practice at Mishcon, said: "JLR's swift action in proactively shutting down and working to restore systems, along with their transparent messaging, shows commendable crisis management."