The cyber attack that crippled Jaguar Land Rover’s operations has been confirmed as the most expensive in British history, with losses estimated at £1.9 billion, according to new analysis from the Cyber Monitoring Centre (CMC).
The incident, which halted JLR production for five weeks from the start of September, disrupted around 5,000 organisations — including parts manufacturers, logistics providers, showrooms and repair shops — and sent shockwaves through the wider UK automotive supply chain.
The CMC described the attack as having “extensive ripple effects through supply chains, logistics providers and local economies,” warning that its economic fallout had far exceeded previous estimates.
The think tank placed total economic losses between £1.6 billion and £2.1 billion, making the JLR breach the single most financially damaging cyber incident ever recorded in the UK.
Professor Ciaran Martin, former head of GCHQ’s National Cyber Security Centre and now chair of the CMC’s technical committee, said the event should serve as a wake-up call for British industry:
“With a cost of nearly £2bn, this incident looks to have been, by some distance, the single most financially damaging cyber event ever to hit the UK.
“That should make us all pause and think. Every organisation needs to identify the networks that matter most, how to protect them, and how to cope if those networks are disrupted.”
The JLR attack was classed as “Category Three” on the CMC’s five-point severity scale — reflecting its high economic cost and widespread impact — but differed from previous systemic events such as the WannaCry ransomware attack on the NHS or this year’s CrowdStrike software failure, as its systemic effects stemmed from a single corporate target.
According to reports in The Telegraph, Russian state-linked hackers are suspected of orchestrating the attack. Intelligence sources believe the scale, precision and economic disruption point to actors operating on behalf of the Kremlin, with the temporary global shutdown affecting up to 200,000 workers.
The fallout led the UK Government to underwrite a £1.5 billion loan guarantee to support JLR and its supplier network amid fears that hundreds of small manufacturers could collapse.
Will Mayes, Chief Executive of the CMC, said the JLR incident underscored how cyber attacks on a single major enterprise can cascade through the wider economy: “We tend to think of systemic cyber risk as something that spreads through shared IT infrastructure or self-propagating malware,” he said.
“What this demonstrates is how an attack on one major manufacturer can ripple through thousands of suppliers, transport firms and local economies, triggering billions in losses. It highlights the fragility of modern supply chains and the need for independent, data-driven analysis to understand national cyber risk.”
The event has reignited debate about the resilience of UK manufacturing, where digitised production systems and just-in-time logistics have made industries more efficient but also more exposed.
Cyber experts are calling for mandatory resilience audits for critical supply chain operators and greater public-private coordination in industrial cybersecurity.
For JLR, which resumed full production only in early October, the challenge now extends beyond recovery — to restoring supplier confidence and fortifying systems against future disruption.
