Currently reading: JLR restarts production following September hack

British firm has not built a car since its computer systems were hacked on 1 September

JLR has restarted production operations today (8 October), more than five weeks after plants were shut down following a cyber attack that incapacitated its entire global business.

This began with the Wolverhampton engine plant and Birmingham battery centre, and will be followed by stamping operations in Castle Bromwich, Halewood and Solihull. 

The Solihull body shop, paint shop and logistics centre – which all feed the British car maker’s global operations – will also restart today.

Vehicle manufacturing will “closely” follow this and begin at an unspecific point this week, said JLR.

This will start with the Land Rover Defender and Land Rover Discovery lines at Nitra, Slovakia, and the Range Rover and Range Rover Sport lines at Solihull. 

When production at Halewood will restart is currently unknown, but JLR said further updates “will follow”.

The plant currently builds the Range Rover Evoque and Land Rover Discovery Sport and is being transformed as part of a £500 million project to produce JLR's incoming EVs.

In what state production will restart is as yet unknown, but it is expected to initially be restricted, given that JLR has referred to resumption of operations as a “controlled, phased restart”.

On Tuesday (7 October), JLR also confirmed that it's setting up a new financing scheme to pay “qualifying” suppliers ahead of the production restart in an effort to “aid their cash flow in the near term”. 

Suppliers have struggled during the production shutdown, with some having to lay off staff just to stay in business. Such have been the difficulties that MPs stepped in and committees were set up.

Back to top

“This week marks an important moment for JLR and all our stakeholders as we now restart our manufacturing operations following the cyber incident,” said JLR CEO Adrian Mardell. 

“From tomorrow, we will welcome back our colleagues at our engine production plant in Wolverhampton, shortly followed by our colleagues making our world‑class cars at Nitra and Solihull.

“Our suppliers are central to our success, and today we are launching a new financing arrangement that will enable us to pay our suppliers early, using the strength of our balance sheet to support their cashflows.

“I would like to thank everyone connected to JLR for their commitment, hard work and endeavour in recent weeks to bring us to this moment. We know there is much more to do but our recovery is firmly under way.”​

The cyber attack on 1 September brought all factories to a halt and incapacitated JLR, forcing it to shut down its internal computer systems in an effort to protect data from being stolen.

This resulted in production shutdowns at all of its global plants, created issues with parts ordering and stifled retailers.

 

The consequence of the cyber attack is estimated to have cost JLR £1.5 billion drop in revenue.

Figures released by the firm last week show that, in the three-month period including the September shutdown, sales to dealers plummeted by nearly a quarter to 66,165.

The drop represents the loss of 21,138 cars compared with the same period in 2024.

“It has been a challenging quarter for JLR,” outgoing CEO Adrian Mardell said in a statement. However, he said that sales in July and August had been “in line with our expectations” before the cyber attack.

JLR will present its second quarter financial report in November.

Government to underwrite £1.5bn JLR loan

The restart announcement comes after the UK government said it will guarantee a £1.5 billion loan to JLR, to help it support suppliers who have been hit by the production shutdown.

Back to top

The loan to the Tata-owned car maker will be issued by a commercial bank but will be underwritten by the UK government.

As well as costing JLR an estimated £50 million a week, the cyber attack has badly hit JLR's suppliers. 

It's estimated that around 150,000 people are employed by some 700 British firms that supply JLR, and the UK government had been investigating ways to support them, such as a furlough scheme or loans.

It will instead underwrite a single loan to JLR through the Export Development Guarantee (EDG), with JLR repaying the money over a period of five years. 

Business secretary Peter Kyle said on 27 September that the loan guarantee "will help support the supply chain and protect skilled jobs in the West Midlands, Merseyside and throughout the UK".

Chancellor Rachel Reeves added that the loan would help JLR "support their supply chain and protect a vital part of the British car industry".

Since the attack, JLR has been able to restore some of its IT systems following the and has started paying some of its suppliers.

JLR hack: what happened?

Autocar first reported issues affecting JLR on 1 September, when dealers couldn't register new cars on 'new plate day', traditionally one of the year's busiest for registrations.

Back to top

In an effort to combat the hack, JLR began “shutting down" its systems on 2 September. It has not produced any cars globally since, leading to millions of pounds of lost income.

The extent of the issues meant JLR brought police and cybersecurity experts in to “restart our global applications in a controlled and safe manner”.

During this process, which included an investigation, it was discovered that "some data" was "affected", according to JLR. Those affected will be contacted, the firm said.

It's not officially known what data was taken or if a ransom demand has been made, but it is thought it most likely involves customer data, given the involvement of the police.

Who has claimed responsibility for JLR hack?

On 3 September, a group of hackers calling themselves Scattered Lapsus$ Hunters claimed responsibility for the attack on JLR.

This is the same group that hacked Marks & Spencer in May, causing the British retailer seven weeks of disruption and costing £300 million in lost operating profit.

It claimed to have obtained JLR customer data after exploiting a similar flaw in the car maker's IT system. The claim was made on a Telegram messenger group, where a user linked to the hackers posted a screenshot of what appeared to show JLR's internal system.

A member of the group revealled that a well-known flaw in SAP Netweaver, a third-party software used by JLR, was exploited to access the data.

The US's Cybersecurity and Infrastructure Security Agency warned about the flaw earlier this year. An update for the software was released, but whether JLR applied it is unknown.

It's also not known what data was taken or if a ransom demand has been made of JLR.

Join our WhatsApp community and be the first to read about the latest news and reviews wowing the car world. Our community is the best, easiest and most direct place to tap into the minds of Autocar, and if you join you’ll also be treated to unique WhatsApp content. You can leave at any time after joining - check our full privacy policy here.

Will Rimell

Will Rimell Autocar
Title: News editor

Will is Autocar's news editor.​ His focus is on setting Autocar's news agenda, interviewing top executives, reporting from car launches, and unearthing exclusives.

As part of his role, he also manages Autocar Business – the brand's B2B platform – and Haymarket's aftermarket publication CAT.

Join the debate

Comments
73
Add a comment…
VioletHazel397 8 October 2025
As a victim of a cryptocurrency scam, I understand the frustration and fear that comes with losing significant investments. I was persuaded to invest $188,600 in what turned out to be a bogus platform, and the realization hit hard when I discovered I had been scammed. It felt like I had lost everything, especially since this was my life savings. However, after nearly losing hope, a friend recommended a service called RHIANNON RECOVERY LOST, and I decided to give it a try. Thanks to their expertise and dedication, I was able to recover my funds in just 42 hours. If you find yourself in a similar situation, I highly recommend reaching out to professionals with proven success in recovering lost crypto assets. With the right help, there is hope, and you can regain what was taken. Contact on via email:  RHIANNONRECOVERYLOST@GMAIL. COM  Also on Telegram or WhatsApp +1 (213) 783-6645..
camilaevelyn211 8 October 2025
RECOVER STOLEN BITCOIN - CLAIM BACK LOST CRYPTO INVESTMENT ACCOUNT META TECH RECOVERY PRO
 
To recover USDT lost in a Crypto/Telegram investment scam, one should seek support and guidance from META TECH RECOVERY PRO if they need professionalism and a high chance of recovering their digital assets. This action represents the initial step in a potentially complex process. The recovery of digital assets, particularly those involved in fraudulent activities, often necessitates specialized knowledge and a strategic approach. META TECH RECOVERY PRO likely possesses the expertise to navigate the intricacies of such situations. This may involve tracing the transaction, identifying the scammer's digital footprint, and potentially collaborating with relevant authorities or blockchain analysis firms. The specific methods employed by META TECH RECOVERY PRO would depend on the nature of the scam, the blockchain involved, and the available information. It is crucial to understand that the success of such recovery efforts is not guaranteed, and the process may be time-consuming. Furthermore, while dealing with META TECH RECOVERY PRO, rest assured that you are getting what you desire for help via.
 
Telegram:@metatechrecoveryproteam
support@metatechrecoverypro.com
W/S  ‪+1 (469) 692 8049‬.
 
Thank you.
monicaabbott86 7 October 2025

I encountered an unexpected issue with my crypto account, leaving me unable to access my Bitcoin wallet. Despite numerous attempts, I was continuously blocked and denied access. With $240,000 at stake, I felt overwhelmed by the thought of losing everything. Thankfully, a ray of hope emerged when I stumbled upon a review about SWIFT HACK EXPERT, a trusted funds recovery service that had successfully assisted countless individuals in similar situations. Without hesitation, I reached out to them, and to my amazement, SWIFT HACK EXPERT was able to retrieve my Bitcoin wallet and restore my funds. I'm immensely grateful to SWIFT HACK EXPERT for their incredible work. For those in need, you can contact through the following channels: swift1@cyberservices.com and WhatsApp +1–845–224–5771