The Cyber Monitoring Centre classed the 2025 Jaguar Land Rover cyber incident as a Category 3 systemic event and estimated a UK financial impact of 1.9 billion pounds, within a range of 1.6 to 2.1 billion. Most of that loss comes from halted manufacturing at the company and its suppliers, not from data theft.
What the estimate says
The CMC's October 2025 statement reports an impact of 1.9 billion pounds and says the event affected over 5,000 UK organisations. The page also cites a figure of more than 2,700 in its categorisation section and does not reconcile the two, so quote the figure with care.
The CMC models plant stoppage of about five weeks, at roughly 108 million pounds of loss per week. The model includes:
- Lost profit and fixed costs at the manufacturer.
- Incident response and IT rebuild costs.
- Supplier losses across all tiers.
- Lost dealer margins, mainly from limited supply rather than weak demand.
- Losses at service centres, logistics firms and exporters.
- Knock-on losses for local businesses as worker income falls.
What the estimate leaves out
The CMC says the figure is scenario based, not confirmed operational data, and that some inputs are anecdotal. It excludes the company's overseas operations, non-UK suppliers and dealers, data breach costs and any ransom payments. It also assumes the government's 1.5 billion pound loan guarantee is not drawn, so no taxpayer cost is included.
The restart assumption matters a great deal. The model has a straight-line recovery from the 8 October announcement of limited production to full production in early January 2026. It notes the loss could be higher if operational technology was significantly affected or recovery slips.
Why a Category 3
The CMC rates events on a five-point scale. This one was concentrated on a single primary victim. Its wider effects came indirectly through economic dependencies, not through many organisations being compromised at the same time.
Lessons for suppliers and manufacturers
- Know your concentration risk. If most of your revenue depends on one customer's plant running, their outage is yours.
- Plan for a long restart, not a short outage. Restarting in phases takes time even after systems are back.
- Separate IT from operations. Public technical detail was limited, and the CMC lists operational technology impact as an unknown. Segmentation decides whether one becomes the other.
- Keep cash and credit plans for supplier outages. The loan guarantee exists because of supplier strain.
- Test the manual fallback. A plant that cannot run without its IT systems has a recovery time set by IT.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation help you document which systems exist and which controls apply, which is the groundwork for these conversations with customers. A free scan is at gold.safeguard.sh/scan.
Quick check
Does the CMC estimate include any ransom paid?
No. It excludes ransom payments and data breach costs.
Is the 1.9 billion pound figure a confirmed loss?
No. The CMC describes it as a scenario based model estimate with a range, not confirmed operational data.
Sources
Last reviewed: 19 October 2026.
