Cyber Recovery
JLR begins phased restart after six-week cyber siege
British luxury carmaker initiates controlled manufacturing resumption following devastating cyberattack, whilst government underwrites £1.5 billion ($2 billion) loan to stabilise supply chain. Economist warns crisis reveals industry vulnerability.
The slow whir of machinery returning to life at Jaguar Land Rover's (JLR) Wolverhampton engine plant on Wednesday, October 8, will be punctuated by the sounds of a much-needed production respite. The date will signal the beginning of recovery from what David Bailey, professor of business economics at the University of Birmingham, describes as "one of the worst crises the company has ever faced."
Six weeks after hackers forced the British luxury carmaker to shut down its global IT systems on 1 September, JLR has begun what it terms a "controlled, phased restart" of operations. Yet the tentative resumption throws into sharp relief the fragility of modern automotive manufacturing, where digital networks and just-in-time vehicle supply chains create vulnerabilities that can cascade across entire industrial ecosystems.
From engines to vehicles: The phased restart
The restart follows a carefully choreographed sequence, beginning with component and body preparation. Wolverhampton's engine facility and Birmingham's battery centre will lead the way, resuming operations on Wednesday, October 8. This initial phase is immediately followed by stamping operations at Castle Bromwich, Halewood, and Solihull. Crucially, the Solihull plant's body shop, paint shop, and logistics centre—which feeds parts to JLR's global operations—will also restart on Wednesday. Vehicle assembly lines are following closely behind.
JLR Chief Executive Adrian Mardell stated, "From tomorrow, we will welcome back our colleagues at our engine production plant in Wolverhampton, shortly followed by our colleagues making our world-class cars at Nitra and Solihull."
The Range Rover and Range Rover Sport production lines at Solihull, along with the Land Rover Defender and Discovery production lines at the Nitra facility in Slovakia, are scheduled to resume operations later in the week following the component restarts. However, the timeline for the full vehicle assembly restart at Halewood, where the Land Rover Evoque and Discovery Sport are built, remains less certain in the initial announcement.
The phased approach reflects the complexity of restarting operations that have been dark for more than a month. The company continues to work alongside cybersecurity specialists, the UK Government's National Cyber Security Centre (NCSC) and law enforcement to ensure the restart proceeds securely.
The financial toll of cyber attacks
The economic impact has been severe. Bailey estimates JLR lost production of approximately 1,000 vehicles daily during the shutdown. Based on normalised output figures, this translates to daily revenue losses of around £72 million ($97 million). With profit margins factored in, the company faced potential daily profit losses between £5 million and £10 million ($6.7 million to $13.4 million).
Over six weeks, the cumulative impact becomes staggering. Economists project potential revenue losses of £2.2 billion ($2.9 billion) and profit impacts of £150 million ($202 million). For context, JLR reported profits that had already nearly halved in July due to US tariffs. "We've seen it get through the global financial crisis, through COVID, through the semiconductor crisis, but we've not had anything like this before, where the company has not made any cars for a month," Bailey stated.
Production halted, not just in the UK, but also at facilities in Slovakia, China, India and Brazil, all integrated through shared planning and digital engineering platforms.
Automotive supply chain in crisis
The shutdown's ripple effects exposed the brittleness of automotive supply networks. A snap survey of 84 businesses conducted by the Black Country, Greater Birmingham and Coventry and Warwickshire Chambers of Commerce found that 77% had been negatively impacted. Of these, 35% had already reduced staff hours or temporarily suspended workers, whilst 14% were making redundancies.
Michael Beese, managing director of Walsall-based Genex UK, which employs 17 people and supplies parts to tier one JLR suppliers, was forced to lay off most of his staff. "We've kept working, building some stock to keep our employees in work, but we've run out of space and material," Beese explained. "I have now laid off staff due to the uncertain short-term future." The human cost of the fallout extends beyond the immediate effects of the shutdown.
Government intervention
The scale of disruption prompted unprecedented government action. On September 27, Business and Trade Secretary Peter Kyle announced that the UK government would underwrite a £1.5 billion loan to JLR. The loan, issued by a commercial bank but guaranteed by the state, aims to stabilise the automotive supply chain and protect skilled jobs across the West Midlands, Merseyside and throughout the UK. "Following our decisive action, this loan guarantee will help support the supply chain and protect skilled jobs," Kyle stated.
JLR has announced it will use the facility to establish a new financing scheme enabling early payment to qualifying suppliers, leveraging its balance sheet to support their cash flow. Mardell emphasised the company's dependence on its supplier network. "Our suppliers are central to our success, and today we are launching a new financing arrangement that will enable us to pay our suppliers early, using the strength of our balance sheet to support their cashflows."
Yet questions remain about whether financial support will cascade effectively through the supply chain. Bailey notes that "providing support directly to supply chain firms is actually tricky as JLR didn't have much of a map of the supply chain beyond its first and second tier suppliers."
The Society of Motor Manufacturers and Traders (SMMT) has been working with JLR to develop a more comprehensive supply chain map. "Guaranteeing a loan via JLR gets cash into the supply chain but ensuring that the cash cascades down the supply chain will be vital," Bailey added. Stephen Morley, president of the Confederation of British Metalforming, argued the loan guarantee was not being deployed quickly enough. "We need to find a way to get money quickly to where it is needed most, to prevent the supply chain from completely collapsing."
Regional economic exposure
The incident has exposed the West Midlands' economic dependence on automotive manufacturing. JLR employs 10,700 people at its Solihull facility alone, roughly a third of its total UK workforce of around 40,000. The plant manufactures a new car every 90 seconds under normal conditions. The broader ecosystem supports an estimated 100,000 to 150,000 jobs. According to Oxford Economics, JLR contributed £8.7 billion ($11.7 billion) to the West Midlands economy in 2024, representing 4.7% of the entire regional output.
"It has done very well in recent years and it's the biggest car producer in the UK, so it's massive and many of the jobs that it supports are very highly paid, they are well paid manufacturing jobs and there aren't that many left of these, so it's actually very important for the regional economy," Bailey explained to CNN.
Steve Whitmarsh, chief executive of Multifleet Vehicle Management, a Solihull-based company, voiced concerns about cascading effects. "I am not sure people realise how reliant Solihull is on the employment from JLR. Almost everyone has a relative or a friend that works at Land Rover." Whitmarsh drew parallels to the closure of the Longbridge factory complex near Birmingham in the early 2000s, which left thousands unemployed. "It's taken 20 years to recover, and it would take 20 years to recover here, I'm very sure, if not longer."
Systemic vulnerabilities and the need for production resilience
The incident raises fundamental questions about automotive manufacturing's digital dependency. Modern production systems integrate design, engineering, manufacturing execution, supply chain management and financial systems into tightly coupled networks. This integration enables the efficiency and flexibility that contemporary manufacturing demands, but creates single points of failure that can paralyse entire operations.
JLR's response, shutting down all IT systems globally on 1 September to contain the breach, followed cybersecurity best practice but had immediate and severe consequences. Production halted, not just in the UK, but also at facilities in Slovakia, China, India and Brazil, all integrated through shared planning and digital engineering platforms.
The attack's timing, as the industry enters the crucial final quarter when manufacturers typically push to meet annual targets, amplified its impact. JLR had already announced 500 management redundancies in July as it grappled with halved profits, making it particularly vulnerable to further disruption.
Bailey suggests the crisis should prompt policy preparation. "A key lesson in all of this is to have a policy toolkit available to be drawn on 'off the shelf' in response to major shocks, using actions like loan guarantees. That was a key finding from our work on MG Rover in the wake of its 2005 collapse, and during the financial crisis."
The incident may also accelerate conversations about cyber resilience in manufacturing. Whilst JLR continues working with the National Cyber Security Centre and law enforcement, the identity of the attackers remains unconfirmed, as does the method of intrusion. Some reports suggest a hacker group linked to social engineering attacks has claimed responsibility, though this has not been verified.
Cybersecurity and uncertainty on production volume and pace
As production gradually resumes, several questions remain unanswered. The phased restart suggests JLR expects it will take several weeks for all three UK factories to reach typical operating speeds. The company has not disclosed specific production targets for the initial restart phase, making it difficult to assess when output will return to pre-attack levels.
The longer-term impact on JLR's market position and customer relationships remains to be seen. Delays in vehicle deliveries during a period of strong demand for luxury SUVs could benefit competitors. The reputational damage from a prolonged production shutdown may also affect enterprise customers and fleet operators, particularly those in sectors with heightened cybersecurity concerns.
Read AMS' Smart Factory stories
For JLR's suppliers, particularly smaller firms that depend heavily on the automaker, the restart brings relief but not necessarily resolution. Many have burned through cash reserves, laid off workers and taken on debt to survive the shutdown. Recovery will be gradual, and some may not survive the transition period even as production resumes.
Trade union Unite, which had pressed for government intervention, offered cautious endorsement of the support package. "This is an important first step and demonstrates that the government has listened to the concerns raised in meetings with Unite over recent days," said Sharon Graham, general secretary. "The money provided must now be used to ensure job guarantees and to also protect skills and pay in JLR and its supply chain."
The Wolverhampton plant's restart represents the beginning of a recovery process that will likely extend well beyond the initial resumption of operations. The full cost of the attack, in financial terms, employment impacts and strategic consequences, will only become clear in the months ahead.
Yet perhaps the most significant legacy will be heightened awareness within automotive manufacturing of cyber vulnerability. In an industry that has embraced digitalisation as essential to competitiveness, the JLR incident serves as a stark demonstration that connectivity creates exposure. How the sector responds to this lesson may shape manufacturing operations for years to come.
