Jaguar Land Rover keeps factories at a standstill for weeks following a cyber attack

What happened

In late August 2025 Jaguar Land Rover detected a cyberattack and proactively shut down its systems, halting production at its UK plants. The stoppage lasted for weeks, with a phased restart from October.

The impact spread through the supply chain, as many suppliers depended on the manufacturer's orders. The UK government went as far as backing a loan guarantee to ease the financial pressure on the group and its suppliers.

Why it matters to manufacturers in Catalonia

In a plant, management systems, planning, logistics and production are all connected. When IT is shut down to contain an attack, the factory can lose its work orders even though the machines still run.

For an automotive or machinery supplier the risk is twofold: its own incident and that of its main customer.

What to review in a plant

Measures that reduce the scope and duration of a stoppage:

• Separate the plant (OT) network from the corporate network and control the crossing points.
• Know which processes can continue manually and for how long.
• Keep recoverable copies of ERP and MES outside the main environment.
• Understand your dependence on key customers and suppliers if they suffer a stoppage.

Frequently Asked Questions

Why did production stop if the attack was on IT?

Because production relies on IT systems to plan, receive parts and record orders; shutting them down to contain the attack left the plant without operational support.

Is an industrial SME exposed to the same risk?

The scale differs but the mechanism is the same: a flat network without recoverable backups multiplies the length of a stoppage.

Where should we start?

With an inventory of plant and office systems, segmentation between them and a real restore test of the management system.