--- title: "JLR Cyber Attack Rated Category 3: £1.9bn UK Im… | Firevault" description: "The Cyber Monitoring Centre has categorised the Jaguar Land Rover cyber incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact#webpage", "url": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact", "name": "JLR Cyber Attack Rated Category 3: £1.9bn UK Im…", "description": "The Cyber Monitoring Centre has categorised the Jaguar Land Rover cyber incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/6dd44b56-e323-49e4-9acd-0d84f02405db/jlr-cyber-incident-cmc-category-3-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "JLR Cyber Attack Rated Category 3: £1.9bn UK Impact, Says Cyber Monitoring Centre", "item": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "JLR Cyber Attack Rated Category 3: £1.9bn UK Impact, Says Cyber Monitoring Centre", "description": "The Cyber Monitoring Centre has categorised the Jaguar Land Rover cyber incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact and disruption to more than 5,000 organisations. It is described as the most economically damaging cyber event ever to hit the UK.", "url": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/6dd44b56-e323-49e4-9acd-0d84f02405db/jlr-cyber-incident-cmc-category-3-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/6dd44b56-e323-49e4-9acd-0d84f02405db/jlr-cyber-incident-cmc-category-3-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/6dd44b56-e323-49e4-9acd-0d84f02405db/jlr-cyber-incident-cmc-category-3-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/6dd44b56-e323-49e4-9acd-0d84f02405db/jlr-cyber-incident-cmc-category-3-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-07-11T11:26:43.751988+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 959, "keywords": "Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "The Cyber Monitoring Centre (CMC) has formally categorised the August 2025 cyber attack on Jaguar Land Rover as a Category 3 systemic event on its five-point scale, with a modelled UK financial impact of £1.9 billion and material losses affecting more than 5,000 UK organisations . According to the CMC, this makes it the most economically damaging cyber event ever to strike the UK. What Happened In", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What HappenedWhy the Category 3 RatingWhere the £1.9 Billion Comes FromThe Human CostThe IT and OT QuestionWhat the CMC RecommendsThe Firevault ViewKey TakeawaysMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · Breach Analysis · 11 July 2026 # JLR Cyber Attack Rated Category 3: £1.9bn UK Impact, Says Cyber Monitoring Centre The Cyber Monitoring Centre has categorised the Jaguar Land Rover cyber incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact and disruption to more than 5,000 organisations. It is described as the most economically damaging cyber event ever to hit the UK. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 5 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjlr-cyber-attack-cmc-category-3-19bn-uk-impact)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjlr-cyber-attack-cmc-category-3-19bn-uk-impact&text=JLR%20Cyber%20Attack%20Rated%20Category%203%3A%20%C2%A31.9bn%20UK%20Impact%2C%20Says%20Cyber%20Monitoring%20Centre%0A%0AThe%20Cyber%20Monitoring%20Centre%20has%20categorised%20the%20Jaguar%20Land%20Rover%20cyber%20incident%20as%20a%20Category%203%20systemic%20event%2C%20estimating%20a%20%C2%A31.9%20billion%20UK%20financial%20impact%20and%20disruption%20to%20more%20than%205%2C000%20organisations.%20It%20is%20described%20as%20the%20most%20economically%20damaging%20cyber%20event%20ever%20to%20hit%20the%20UK.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjlr-cyber-attack-cmc-category-3-19bn-uk-impact)[](mailto:?subject=JLR%20Cyber%20Attack%20Rated%20Category%203%3A%20%C2%A31.9bn%20UK%20Impact%2C%20Says%20Cyber%20Monitoring%20Centre&body=The%20Cyber%20Monitoring%20Centre%20has%20categorised%20the%20Jaguar%20Land%20Rover%20cyber%20incident%20as%20a%20Category%203%20systemic%20event%2C%20estimating%20a%20%C2%A31.9%20billion%20UK%20financial%20impact%20and%20disruption%20to%20more%20than%205%2C000%20organisations.%20It%20is%20described%20as%20the%20most%20economically%20damaging%20cyber%20event%20ever%20to%20hit%20the%20UK.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fjlr-cyber-attack-cmc-category-3-19bn-uk-impact) ![Silhouetted Jaguar Land Rover vehicle on a halted UK factory assembly line under red warning lights, illustrating the JLR cyber incident](/__l5e/assets-v1/6dd44b56-e323-49e4-9acd-0d84f02405db/jlr-cyber-incident-cmc-category-3-2x.jpg) Silhouetted Jaguar Land Rover vehicle on a halted UK factory assembly line under red warning lights, illustrating the JLR cyber incident Why it matters ## What this means for organisations holding critical data The Cyber Monitoring Centre has categorised the Jaguar Land Rover cyber incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact and disruption to more than 5,000 organisations. It is described as the most economically damaging cyber event ever to hit the UK. In this analysis 1. 01 [What Happened](#section-0) 2. 02 [Why the Category 3 Rating](#section-1) 3. 03 [Where the £1.9 Billion Comes From](#section-2) 4. 04 [The Human Cost](#section-3) 5. 05 [The IT and OT Question](#section-4) 6. 06 [What the CMC Recommends](#section-5) **On this page**[What Happened](#section-0)[Why the Category 3 Rating](#section-1)[Where the £1.9 Billion Comes From](#section-2)[The Human Cost](#section-3)[The IT and OT Question](#section-4)[What the CMC Recommends](#section-5)[The Firevault View](#section-6) The **Cyber Monitoring Centre** (CMC) has formally categorised the August 2025 cyber attack on **Jaguar Land Rover** as a **Category 3 systemic event** on its five-point scale, with a modelled UK financial impact of **£1.9 billion** and material losses affecting more than **5,000 UK organisations**. According to the CMC, this makes it the most economically damaging cyber event ever to strike the UK. ## What Happened In late August 2025, Jaguar Land Rover suffered a major cyber incident that forced a shutdown of its internal IT environment and halted global manufacturing operations. The UK plants at Solihull, Halewood and Wolverhampton stood idle for approximately five weeks. Dealer systems were intermittently unavailable, and thousands of suppliers faced cancelled or delayed orders. JLR has since announced a controlled, phased restart, with full production not expected until early 2026. ## Why the Category 3 Rating The CMC scale ranges from Category 1 to Category 5. A Category 3 rating reflects a systemic event with financial losses between £1 billion and £5 billion, and material impact to more than 2,700 UK organisations. The modelled range for the JLR event is £1.6 billion to £2.1 billion, sensitive to assumptions about recovery pace and any impact on operational technology. Unlike WannaCry or the CrowdStrike outage, where damage propagated across many organisations in parallel, the JLR event was concentrated on a single primary victim. The systemic damage cascaded outward through economic interdependencies: tier one, two and three suppliers, logistics providers, dealerships, service centres and local economies around the plants. ## Where the £1.9 Billion Comes From The CMC's analysis attributes the loss to six components: - **JLR business interruption:** Roughly 5,000 vehicles per week of lost UK production, valued at around £108 million per week in lost profit and fixed costs. - **Incident response and IT rebuild costs:** Forensic investigation and restoration of the compromised IT estate. - **Supply chain business interruption:** Losses cascading through nearly one thousand tier one suppliers and thousands of lower-tier firms, some of whom faced severe cash flow pressure. - **Reduced vehicle sales:** Lost dealer margin driven primarily by supply shortfall rather than weakened demand. - **Downstream losses:** Impact on service centres, exporters and vehicle logistics providers. - **Induced local business losses:** Reduced spending by JLR and supplier employees in local economies. Notably, the estimate excludes any losses from the apparent [data breach](/learn/breaches) element of the incident, and does not assume any ransom was demanded or paid. ## The Human Cost Beyond the financial figures, the CMC highlights significant human impact. Automotive suppliers have reduced pay, banked hours and, in some cases, laid off staff to remain viable. Threats to job security can weaken household resilience and compound existing regional and economic inequalities. ## The IT and OT Question The CMC notes that unusually few technical details have emerged publicly. One of the most consequential unknowns is whether **operational technology** was affected. JLR's decision to shut down suggests attackers had reached, or were close to reaching, sensitive operational infrastructure, raising the possibility of IT to OT crossover. This is the exact scenario that has defined recent high-impact industrial incidents, from Colonial Pipeline to critical national infrastructure attacks. ## What the CMC Recommends The CMC Technical Committee sets out clear guidance for boards, manufacturers, government and insurers: - **Recognise operational disruption as the primary cyber risk.** Future high-impact events are far more likely to arise from disruption than from data exfiltration. - **Strengthen IT and OT resilience.** Boards should identify critical digital assets, test compromise scenarios, and ensure recovery plans exist when key systems fail. Reinforcing IT to OT boundaries limits attack propagation. - **Map supply chain dependencies.** Suppliers with heavy revenue concentration in a single customer should hold liquidity buffers and prepare mitigation strategies for extended shutdowns. - **Evaluate cyber insurance coverage.** Current products often exclude losses from disruption to critical buyers or customers. - **Define government support parameters.** Following the £1.5 billion loan guarantee to JLR, clearer frameworks are needed for future interventions. ## The Firevault View The JLR event is a defining data point for UK cyber policy. It confirms what the operational technology community has argued for years: the loss that ends up on the board's agenda is not the stolen record, it is the halted line. When production stops, the cost is measured in hundreds of millions per week, and no amount of data-loss insurance recovers it. Firevault exists because segmentation, monitoring and immutable cloud snapshots are not enough on their own. Once an attacker is inside the corporate IT estate, the safest boundary between IT and OT is the one that cannot be reached from the network at all. A **Layer 1 [physical air gap](/how-it-works/offline-secure-storage)** ensures that recovery images, control logic, engineering backups and the crown jewels an attacker needs to reach OT sit on media that is _physically disconnected_ when not in use. There is no tunnelling across, no credential to steal, no firewall rule to misconfigure. The CMC's recommendation to identify critical digital assets, challenge compromise scenarios and hold recoverable copies of what matters most is the operating model Firevault is built for. When the next Category 3 event lands, the organisations that recover fastest will be the ones whose most important data was offline the moment the attacker got in. ## Key Takeaways - **Category 3 rating:** The JLR incident is the most economically damaging cyber event ever recorded in the UK. - **£1.9 billion modelled loss:** Range of £1.6bn to £2.1bn, with over 5,000 UK organisations materially affected. - **Disruption, not data theft, drives the cost:** Virtually all of the loss stems from halted manufacturing output. - **IT to OT crossover risk remains the critical unknown:** Boards should treat this boundary as a first-order resilience issue. - **Recovery depends on what is protected offline:** Physically disconnected copies of critical assets are the foundation of a credible restart plan. _Source: [Cyber Monitoring Centre statement, 22 October 2025](https://cybermonitoringcentre.com/2025/10/22/cyber-monitoring-centre-statement-on-the-jaguar-land-rovercyber-incident-october-2025/)._ About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ ![AnMed Closes Facilities Following Ransomware Attack and Data Claims](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/anmed-facility-closures-following-ransomware-cyberattack-1786723492583.png) Breach Analysis ### AnMed Closes Facilities Following Ransomware Attack and Data Claims South Carolina health system AnMed was forced to close 83 facilities following a cyberattack. Threat actors subsequently claimed to hold 6 terabytes of sensitive patient records. 14 Aug 2026 4 min ](/news/anmed-facility-closures-following-ransomware-cyberattack)[ ![US directive allows private firms to conduct offensive cyber operations](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png) Breach Analysis ### US directive allows private firms to conduct offensive cyber operations US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory attacks and collateral system disruptions. 14 Aug 2026 3 min ](/news/us-directive-private-firms-offensive-cyber-operations)[ ![Adobe Commerce attacked immediately after session breach vulnerability](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/adobe-commerce-session-vulnerability-exploited-after-disclosure-1786684691416.png) Breach Analysis ### Adobe Commerce attacked immediately after session breach vulnerability Security firm Sansec blocked attacks targeting Adobe Commerce immediately after disclosure. The flaw allows unauthenticated attackers to hijack sessions and customer data. 14 Aug 2026 4 min ](/news/adobe-commerce-session-vulnerability-exploited-after-disclosure)[ ![Cornelius faces legal investigation after alleged Cl0p cyber attack](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/cornelius-alleged-clop-ransomware-data-breach-1786684482605.png) Breach Analysis ### Cornelius faces legal investigation after alleged Cl0p cyber attack Cornelius faces legal scrutiny following reports of a Cl0p ransomware breach in August 2026. Claims suggest thousands of gigabytes of corporate data were compromised. 14 Aug 2026 4 min ](/news/cornelius-alleged-clop-ransomware-data-breach)[ ![Rogue Wi-Fi at 35,000 Feet: What the Delta Flight 591 Incident Teaches About Network Trust](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdelta-rogue-wifi-defcon-2026.jpg) Breach Analysis ### Rogue Wi-Fi at 35,000 Feet: What the Delta Flight 591 Incident Teaches About Network Trust Delta Air Lines is investigating an unauthorised Wi-Fi network broadcast aboard Flight 591 from Las Vegas to Atlanta, alongside a deauthentication attack that knocked passengers off the aircraft network. The lesson is not about aviation. It is about how easily a trusted connection can be impersonated. 13 Aug 2026 4 min ](/news/delta-flight-rogue-wifi-deauth-attack-def-con-2026)[ ![Ransomware Attacks Spike 20% in July While AI Steals the Headlines](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg) Breach Analysis ### Ransomware Attacks Spike 20% in July While AI Steals the Headlines Ransomware attacks jumped nearly 20 per cent in July, with 799 incidents logged globally. While AI dominates security headlines, finance, technology, pharmaceutical, medical billing and education organisations absorbed the sharpest increases. 12 Aug 2026 4 min ](/news/ransomware-attacks-spike-july-2026-ai-distraction) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)