Cyberattack halts Jaguar Land Rover production: factories will be idle until Tuesday

By: Volodymyr Kolominov | 04.09.2025, 22:09
How JLR is turning the Hailwood plant into an epicentre of innovation JLR's Hailwood plant. Source: Jaguar Land Rover

Jaguar Land Rover has suffered major disruption at its Hailwood plant in England due to a targeted cyber attack. Car production stopped back on 1 September, and after several days of assembly line downtime, workers were asked not to return to their shifts until at least 9 September.

Here's What We Know

The problems have also affected the Solihull plant, where Range Rover and Range Rover Sport SUVs are produced. The company declined to comment on the extent of the attack, but said it began "shutting down systems" on Tuesday and is now busy restoring them. A timeline for resolving the problem has not yet been set.

The failure in JLR's IT systems has also seriously complicated the work of dealers: they cannot order and select parts through the official software, and in some cases - even transfer cars to customers. Cars have to be registered manually, liaising with the British road authority DVLA. Nevertheless, the brand has managed to register around 6,000 cars this week.

The problems were first reported on 1 September - the day of registration plate changes, which is traditionally one of the busiest days for the UK car market.

Responsibility for the cyberattack

On 3 September, the Scattered Spider group claimed to be behind the attack on JLR. Previously, the same hackers attacked retailer Marks Spencer, causing a seven-week disruption and £300m in losses.

According to The Telegraph, along with the Shiny Hunters group, the attackers claim to have gained access to customer data by exploiting a vulnerability in SAP Netweaver software. The hole was warned about by the US Cybersecurity and Infrastructure Protection Agency (CISA) and an update was subsequently issued. However, it is not known if JLR has installed it.

In an official statement, JLR emphasised that it had not detected a leak of customer data.

According to The Telegraph, the said hacking groups include teenagers from English-speaking countries.

Source: Autocar