A cyber incident at Jaguar Land Rover has stopped vehicle production in the UK for more than three weeks, and the effects are spreading to the companies that supply it. The case shows how a disruption at one organisation can become a financial and employment problem for many others. Boards can use it to test how well they understand the cyber dependencies running in both directions through their own supply chain.
What is on the public record
The incident began at the end of August 2025, and Jaguar Land Rover paused production on 1 September. The company said it had shut down its systems to contain the impact, and it later disclosed that some data had been affected. It is working with cyber security specialists, the National Cyber Security Centre and law enforcement. A group calling itself Scattered Lapsus$ Hunters has claimed responsibility. That claim, and reports about how the attackers gained access, remain unconfirmed.
On 23 September the company extended the pause in production to 1 October, after an earlier plan to restart on 24 September. Plants at Solihull, Halewood and Wolverhampton remain closed.
The effect on suppliers is already visible. On 19 September the Department for Business and Trade and the Society of Motor Manufacturers and Traders issued a joint statement describing a significant impact on Jaguar Land Rover and on the wider automotive supply chain. Trade press reports that the company's UK supply chain employs around 100,000 people. Unite, the trade union, has warned that thousands of jobs are at risk and has called for a government-backed furlough scheme for affected suppliers.
How disruption travels through a supply chain
Cyber risk can reach an organisation from two directions. A supplier that is compromised can disrupt the organisation's own operations or expose its data. A customer that is compromised can stop ordering, receiving or paying, and that loss of demand can threaten a supplier's cash flow within weeks.
The Jaguar Land Rover case illustrates the second direction. Where a supplier depends on one customer for a large share of its revenue, an extended outage at that customer can become a solvency question for the supplier, however strong its own security. Where many suppliers in a sector share that dependency, the effect can spread across a regional economy.
A board's view of cyber risk therefore needs to include the organisations it depends on and the organisations that depend on it. The second group matters to large organisations as well, because a supplier that fails during a customer's outage can delay that customer's recovery when production restarts.
Mapping dependencies and single points of failure
The starting point is a clear picture of which suppliers and customers the organisation could least afford to lose, and for how long. For each critical supplier, management can establish what the supplier provides, what access it has to the organisation's systems and data, whether an alternative source exists, and how long the organisation could operate without it.
This exercise can reveal concentrations that procurement records alone may miss. Examples include a single software platform that several business units rely on, a logistics provider with access to scheduling systems, or a manufacturer that is the only qualified source of a component. Where a single point of failure exists, the board can decide whether to accept it, reduce it through a second source or stock, or plan around it.
Setting proportionate expectations for suppliers
The NCSC's supply chain security guidance advises organisations to understand the risks their suppliers pose, set security requirements in proportion to those risks, and build assurance into contracts and ongoing management. Larger suppliers with privileged access may warrant detailed requirements and evidence. Smaller suppliers may need clear minimum standards, such as Cyber Essentials certification, and practical guidance on meeting them.
Regulation points in the same direction. NIS2 includes supply chain security among the cybersecurity risk-management measures that essential and important entities must take. DORA requires financial entities to manage the risk arising from their ICT third-party service providers. In the UK, the government has said that its forthcoming Cyber Security and Resilience Bill would give regulators powers to designate certain suppliers as critical and bring them within the regulatory regime.
Planning for joint response and recovery
An incident response plan that covers only the organisation's own systems leaves gaps when a key supplier or customer is the one affected. Plans can set out how the organisation would learn of an incident at a critical supplier, who would decide whether to disconnect shared systems, how the two organisations would communicate during the incident, and what evidence would be needed before reconnecting.
Recovery also has a commercial dimension. Where a major customer or supplier is offline for weeks, the organisation may need options for cash flow, staffing and alternative supply, agreed in advance with finance and operations. Exercising a scenario in which a critical partner is unavailable for a month can show whether those options are realistic.
Sharing information with peers and government can shorten the time it takes to recognise a threat that is affecting a sector. The NCSC and sector bodies provide routes for this, and organisations can decide in advance what they would share and with whom.
Questions for the board
- Which suppliers and customers could we least afford to lose, and for how long could we operate without each?
- Where do we depend on a single supplier, platform or customer, and have we decided to accept, reduce or plan around that dependency?
- What access do our critical suppliers have to our systems and data, and how do we gain assurance that it is protected?
- Do our contracts require critical suppliers to notify us promptly of a cyber incident and cooperate in the response?
- How would we decide whether to disconnect from a supplier or customer that has been compromised, and who has that authority?
- If our largest customer stopped trading with us for a month, what would happen to our cash flow and workforce?
- When did we last exercise a scenario involving an incident at a critical supplier or customer?
A Critical Supplier Cyber Risk Review establishes which supplier relationships carry material cyber risk and where the organisation's dependencies need attention.
References
- Department for Business and Trade and Society of Motor Manufacturers and Traders, "Joint statement on the impact of the cyber incident at JLR", 19 September 2025.
- BBC News, "Jaguar Land Rover production severely hit by cyber attack", 2 September 2025.
- Security Affairs, "Jaguar Land Rover discloses a data breach after recent cyberattack", September 2025.
- Infosecurity Magazine, "Jaguar Land Rover extends production pause again", 23 September 2025.
- Fleet News, "Government officials meet with JLR supply chain", September 2025.
- Wired, reporting on the Jaguar Land Rover shutdown, 22 September 2025.
- National Cyber Security Centre, "Supply chain security guidance".
- European Parliament and Council, Directive (EU) 2022/2555 (NIS2), 14 December 2022.
- European Parliament and Council, Regulation (EU) 2022/2554 (Digital Operational Resilience Act), 14 December 2022.
- Department for Science, Innovation and Technology, "Cyber Security and Resilience Bill: policy statement", 1 April 2025.