Merseyside: Jaguar Land Rover (JLR) has confirmed that a cyber-attack has severely disrupted vehicle production at its two main UK plants, forcing operations to a halt at a crucial time for sales.
The British carmaker, owned by India’s Tata Motors, said it took immediate action to contain the breach and shut down IT systems in an attempt to minimise damage. The incident has also hit JLR’s retail business, but the company stressed there is currently no evidence that customer data has been compromised.
The attack began, coinciding with the release of new registration plates on September 1. The disruption was first reported at JLR’s Halewood plant in Merseyside, where workers were told not to report for duty. Staff at its Solihull facility were also sent home after the system shutdown.

JLR stated that, “We took immediate action to mitigate its impact by proactively shutting down our systems. We are now working at pace to restart our global applications in a controlled manner.” The National Crime Agency confirmed it is aware of the incident and is working with partners to assess the scale of the impact.
Although JLR avoided directly referencing a cyber-attack, parent company Tata Motors described it as an ‘IT security incidence’ with global implications in a filing to the Bombay Stock Exchange.
The disruption comes as the company faces pressure from rising costs and tariffs, and follows a series of high-profile ransomware attacks on major UK retailers, including Marks & Spencer and the Co-op, where hackers attempted extortion.
In 2023, JLR signed a five-year $1.06 billion (£800 million) deal with Tata Consultancy Services to support its digital transformation, including cybersecurity. The latest attack raises questions about the vulnerability of even well-defended corporate systems.

