Jaguar Land Rover cyberattack (2025)
A late-August 2025 cyberattack that halted production at a major UK carmaker for several weeks and weakened its suppliers, to the point that the state guaranteed a 1.5 billion pound loan; the company had no cyber cover.
In late August 2025, Jaguar Land Rover, the UK's largest carmaker, discovered an intrusion into its systems and shut them down as a precaution. Its UK plants and other sites stopped: production resumed only gradually in early October, after about five weeks. A collective linked to the Scattered Spider network claimed the attack. The effects went beyond the company: hundreds of suppliers, often small firms living on its orders, were left without revenue, and some threatened layoffs. At the end of September, the UK government granted a state guarantee on a 1.5 billion pound loan to the carmaker to support the supply chain. The press reported that the group had not finalized cyber cover. Published estimates put the episode's cost to the UK economy at about two billion pounds, which would make it one of the costliest cyberattacks in the country's history. The case revived the debate on cyber insurance for large industrial companies, on the dependence of unprotected suppliers on a single customer, and on the role of the state when an uninsured private loss threatens an entire sector: precisely the question of the public backstop that insurance has not yet settled.
In October 2025, the UK cyber event rating body CMC ranked the attack as a category 3 event and estimated its cost to the UK economy at about 1.9 billion pounds, spread across more than 5,000 organizations: the costliest cyber event it has assessed.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.