LONDON : The August 2025 breach crippled production across JLR’s global network and disrupted supply chains for weeks.

The Cyber Monitoring Centre (CMC), an independent non-profit tracking major cyber incidents, on Wednesday (October 22) classified the JLR hack as a Category 3 systemic event, its highest-impact rating yet for a private-sector breach. The CMC’s model places total losses between £1.6 billion and £2.1 billion, with the majority stemming from halted manufacturing and cascading disruptions across suppliers, dealers, and logistics networks.

The attack, which struck JLR’s internal IT environment in late August, forced the luxury automaker to suspend operations through September. Key production plants in Solihull, Halewood, and Wolverhampton were temporarily shut, while dealer systems faced intermittent outages and suppliers reported cancelled or delayed orders.

“The financial impact appears to be the largest ever recorded for a cyber event in the U.K.,” the CMC said, noting the wide-ranging economic fallout from manufacturing stoppages and supplier distress. It added that the incident had “significant human impact,” with some suppliers cutting pay or staff to stay afloat.

JLR, which has yet to comment directly on the CMC findings, confirmed earlier this month that it has begun a phased restart of operations. The company also introduced a new financing solution to help stabilise supplier cashflows.

The CMC warned that the eventual loss could rise further if recovery delays persist or operational systems remain impaired. The cyber incident, now dubbed a “systemic shock” by analysts, has reignited concerns about the resilience of the U.K.’s manufacturing sector to cyber threats, especially those targeting critical supply chains.