Tata Motors JLR cyber-hack worst in UK history that hit 5,000 firms, research finds

London: The recent cyber-hack of Tata Motors-owned Jaguar Land Rover (JLR) was on Wednesday designated as the most damaging cyber event to hit the UK, causing a financial hit of 1.9 billion pounds to the economy and impacting over 5,000 businesses.

The Cyber Monitoring Centre (CMC), an independent non-profit that evaluates cyber events in the UK, categorised JLR's "malicious cyber incident” as a Category 3 systemic event on its five-point scale.

The luxury carmaker, which has not directly commented on the CMC data, has said that it is bringing its stalled operations back online in a phased manner.

“The CMC model estimates the event caused a UK financial impact of 1.9 billion pounds and affected over 5,000 UK organisations," the centre said in a statement.

“The modelled range of loss is 1.6 billion pounds to 2.1 billion pounds, but this could be higher if operational technology has been significantly impacted or there are unexpected delays in bringing production back to pre-event levels. This estimate reflects the substantial disruption to JLR’s manufacturing, to its multi-tier manufacturing supply chain, and to downstream organisations including dealerships," it stated.

The cyber-attack in late August forced a complete shutdown of production through September across the automotive major’s global operations and it is yet to fully resume its pre-hack schedule.

“The estimate is sensitive to key assumptions, including the date JLR is able to fully restore production and the profile of the recovery,” CMC notes.

“At 1.9 billion pounds of financial loss, this incident appears to be the most economically damaging cyber event to hit the UK, with the vast majority of the financial impact being due to the loss of manufacturing output at JLR and its suppliers," it said.

The incident hit JLR’s internal IT environment, leading to an IT shutdown and a halt in manufacturing operations across UK plants at Solihull, Halewood, and Wolverhampton. Production lines were halted for several weeks, dealer systems were intermittently unavailable, and suppliers faced cancelled or delayed orders, with uncertainty about future order volumes.

In a statement on October 7, JLR had announced a “phased restart of its operations and the agreement of a new financing solution to support the cashflow of qualifying JLR suppliers”.

“Our suppliers are central to our success, and today we are launching a new financing arrangement that will enable us to pay our suppliers early, using the strength of our balance sheet to support their cashflows. We know there is much more to do but our recovery is firmly underway,” JLR CEO Adrian Mardell said at the time.

The CMC matrix that places the online attack as a “Category 3 systemic event” reflects the deep impact on one of the UK’s largest manufacturers and the extensive ripple effects through supply chains, logistics providers, and local economies.

It added: “The human impact of this event is also significant. While it has not endangered lives in the same way as previous events in the healthcare industry, the event has impacted job security, with automotive suppliers taking a range of measures to maintain the viability of their businesses, including reducing pay, banking hours, and in some cases laying off staff.

“Threats to job security can have serious consequences for mental and physical well-being, weaken household resilience, and be compounded by existing social, regional, or economic inequalities.” The CMC said its analysis aims to bring transparency to major cyber incidents in the country, highlighting not only their direct financial impact but also their cascading economic and societal impacts.