--- title: "Jaguar Land Rover: Production Severely Hit by C… | Firevault" description: "A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025#webpage", "url": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025", "name": "Jaguar Land Rover: Production Severely Hit by C…", "description": "A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Jaguar Land Rover: Production Severely Hit by Cyber-Attack", "item": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Jaguar Land Rover: Production Severely Hit by Cyber-Attack", "description": "A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates came in. Here is why physical disconnection matters for OT.", "url": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/images/og/og-news-article.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2025-10-10T09:00:00+00:00", "dateModified": "2026-07-04T16:03:24.303926+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/jaguar-land-rover-ransomware-2025" }, "inLanguage": "en-GB", "articleSection": "Offline Security", "wordCount": 799, "keywords": "Jaguar, Offline Security, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "On the last weekend of August 2025, Jaguar Land Rover was hit by a cyber-attack that severely disrupted vehicle production at its two main UK plants. The company, owned by India's Tata Motors, said it took immediate action by proactively shutting down its IT systems to lessen the impact and is working at pace to restart global applications in a controlled manner. The timing could hardly have been ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2025 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What HappenedThe Cost, in NumbersWhy This Attack Was So DamagingWhat Physical Disconnection Woul…Lessons for Manufacturing and CNIConclusionShareMore Resources [Knowledge Vault](/learn/knowledge)/ Offline Security Offline Security · 10 October 2025 # Jaguar Land Rover: Production Severely Hit by Cyber-Attack A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates came in. Here is why physical disconnection matters for OT. ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) Mark Fermor Director & Co-Founder, Firevault 4 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025&text=Jaguar%20Land%20Rover%3A%20Production%20Severely%20Hit%20by%20Cyber-Attack%0A%0AA%20cyber-attack%20severely%20disrupted%20JLR's%20UK%20vehicle%20production%2C%20forcing%20plants%20at%20Halewood%20and%20Solihull%20offline%20just%20as%20the%20new%20September%20registration%20plates%20came%20in.%20Here%20is%20why%20physical%20disconnection%20matters%20for%20OT.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025)[](mailto:?subject=Jaguar%20Land%20Rover%3A%20Production%20Severely%20Hit%20by%20Cyber-Attack&body=A%20cyber-attack%20severely%20disrupted%20JLR's%20UK%20vehicle%20production%2C%20forcing%20plants%20at%20Halewood%20and%20Solihull%20offline%20just%20as%20the%20new%20September%20registration%20plates%20came%20in.%20Here%20is%20why%20physical%20disconnection%20matters%20for%20OT.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025) Offline Security #OSSOffline Secure Storage® Article record **Offline Security**Category **10 October 2025**Published **4 min read**Reading time **Mark Fermor**Written by Why it matters ## What this means for organisations holding critical data A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates came in. Here is why physical disconnection matters for OT. In this analysis 1. 01 [What Happened](#section-0) 2. 02 [The Cost, in Numbers](#section-1) 3. 03 [Why This Attack Was So Damaging](#section-2) 4. 04 [What Physical Disconnection Woul…](#section-3) 5. 05 [Lessons for Manufacturing and CNI](#section-4) 6. 06 [Conclusion](#section-5) **On this page**[What Happened](#section-0)[The Cost, in Numbers](#section-1)[Why This Attack Was So Damaging](#section-2)[What Physical Disconnection Woul…](#section-3)[Lessons for Manufacturing and CNI](#section-4)[Conclusion](#section-5) On the last weekend of August 2025, Jaguar Land Rover was hit by a cyber-attack that severely disrupted vehicle production at its two main UK plants. The company, owned by India's Tata Motors, said it took immediate action by proactively shutting down its IT systems to lessen the impact and is working at pace to restart global applications in a controlled manner. The timing could hardly have been worse. The attack began on Sunday, one day before the new '75' registration plates became available on 1 September — traditionally one of the busiest windows in the UK new-car calendar. ## What Happened The BBC understands the attack was detected while in progress, and JLR shut down its IT systems in an effort to minimise damage. Workers at the Halewood plant in Merseyside were emailed early on Monday morning telling them not to come into work, while staff at the Solihull plant were also sent home. JLR's statement stopped short of using the word 'cyber-attack', but a parallel filing by parent company Tata Motors to the Bombay Stock Exchange described an 'IT security incidence' causing 'global' issues. The National Crime Agency confirmed it was aware of the incident and working with partners to understand the impact. The company said there was no evidence that customer data had been stolen. ## The Cost, in Numbers - **Two main UK plants** — Halewood and Solihull — with production severely disrupted. - **Workers sent home** at Halewood on Monday morning as IT systems were pulled down. - **Retail business hit** during the traditionally popular new-plate release period. - **Global applications** taken offline as JLR contained the incident. - **No evidence** of customer data theft, according to the company's initial statement. > Source: [Jaguar Land Rover production severely hit by cyber-attack — BBC News](https://www.bbc.co.uk/news/articles/c9wywvllq7wo) ## Why This Attack Was So Damaging Modern automotive manufacturing is not a factory. It is a network. Robots, MES systems, ERP, quality systems, supplier portals, telematics platforms and design archives all share data continuously. That interconnection delivers world-class efficiency. It also means that when one part of the estate becomes untrustworthy, the safe response is often to stop everything. JLR's decision to shut down IT systems as soon as the intrusion was detected was the right one. It also reveals the underlying problem: the same connectivity that enables production also makes containment an all-or-nothing choice. When the safe move is a global shutdown, the recovery clock starts on every plant at once. The attack follows the same pattern that hit Marks & Spencer and the Co-op earlier in the year, both of which resulted in extortion attempts. JLR signed an £800m, five-year deal with corporate stablemate Tata Consultancy Services in 2023 to accelerate digital transformation, including cybersecurity — a reminder that mature supplier arrangements are not, on their own, a defence against a determined attacker. ## What Physical Disconnection Would Have Changed Firevault's product family, and the Firebreak approach in particular, is built for exactly this class of incident. - **Firebreak physically severs network segments on demand.** In an active incident, plants, lines or zones can be isolated in seconds without waiting for firewall change control. Contain fast, and the blast radius shrinks. - **Offline copies of engineering and calibration data** in a Vault or Storage estate can be brought back online quickly and cleanly, shortening restart time. - **Control Blueprints** for OT and CNI show how to structure a modern, resilient factory network so that a single event does not force a global shutdown to stay safe. None of this prevents the initial intrusion. What it changes is the recovery curve, and it is the recovery curve that translates directly into the pound-and-pence cost of an incident. ## Lessons for Manufacturing and CNI - Assume ransomware will eventually reach your OT environment. Design the network so that assumption does not become a catastrophic event. - Hold engineering and calibration data offline. When it is what you need to restart, it cannot also be what an attacker can hold to ransom. - Have a physical containment capability that does not depend on the same tools an attacker may already control. Firebreak exists precisely because logical segmentation is not always enough. - Recognise the supply chain dimension. When a major manufacturer goes down, smaller suppliers feel it fast. ## Conclusion The JLR attack is the clearest signal yet that cyber risk in advanced manufacturing has moved from IT concern to national economic concern. The organisations that fare best from the next attack of this scale will be those that have already made two decisions: which data belongs offline, and how quickly they can physically sever a network segment when things go wrong. Explore [Firebreak](/firebreak) for rapid physical network protection, or [Control Blueprints](/control-blueprints) for reference architectures built for OT and CNI. About the author ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Physical disconnection removes the path an attacker needs Offline Secure Storage® holds a clean copy of your data on hardware that is physically disconnected, so an intrusion cannot reach it, encrypt it or delete it. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your data sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Command**Access windows and retrieval under your control **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ Firevault Offline Security ### Marks & Spencer: The £300m Cyber Lesson A ransomware attack on M&S paused online orders from late April into July, hit profits by an estimated £300 million and exposed customer data. The root cause is a familiar one: too much critical data left connected. 20 Oct 2025 4 min ](/news/marks-and-spencer-cyberattack-2025)[ Firevault Offline Security ### Co-op: £80m Profit Hit, 6.5 Million Members Exposed A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is what happened, and why offline storage matters. 15 Oct 2025 4 min ](/news/co-op-cyberattack-2025)[ ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight ### Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. 23 Aug 2026 4 min ](/news/iran-linked-hackers-uk-power-plant-shutdown-2026)[ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026)[ ![When Access Fails: Continuity Needs Offline Secure Storage](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/when-the-grid-fails-offline-secure-storage-business-continuity-2026.jpg) Industry Insight ### When Access Fails: Continuity Needs Offline Secure Storage Fire and grid failure are only one of six ways organisations lose access to their own records. A practical case for holding critical material offline, whatever the cause. 18 Aug 2026 9 min ](/news/when-the-grid-fails-offline-secure-storage-business-continuity) Share this article Offline Security 10 October 2025 4 min read ## Jaguar Land Rover: Production Severely Hit by Cyber-Attack A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates came in. Here is why physical disconnection matters for OT. ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) Published by Mark Fermor , Director & Co-Founder Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025&text=Jaguar%20Land%20Rover%3A%20Production%20Severely%20Hit%20by%20Cyber-Attack%0A%0AA%20cyber-attack%20severely%20disrupted%20JLR's%20UK%20vehicle%20production%2C%20forcing%20plants%20at%20Halewood%20and%20Solihull%20offline%20just%20as%20the%20new%20September%20registration%20plates%20came%20in.%20Here%20is%20why%20physical%20disconnection%20matters%20for%20OT.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025)[](mailto:?subject=Jaguar%20Land%20Rover%3A%20Production%20Severely%20Hit%20by%20Cyber-Attack&body=A%20cyber-attack%20severely%20disrupted%20JLR's%20UK%20vehicle%20production%2C%20forcing%20plants%20at%20Halewood%20and%20Solihull%20offline%20just%20as%20the%20new%20September%20registration%20plates%20came%20in.%20Here%20is%20why%20physical%20disconnection%20matters%20for%20OT.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fjaguar-land-rover-ransomware-2025) [Read full article](https://fire-vault.com/news/jaguar-land-rover-ransomware-2025) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/offline-secure-storage/what-is-oss) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)