Currently reading: JLR restarts production following September hack

British firm has not built a car since its computer systems were hacked on 1 September

JLR has restarted production operations today (8 October), more than five weeks after plants were shut down following a cyber attack that incapacitated its entire global business.

This began with the Wolverhampton engine plant and Birmingham battery centre, and will be followed by stamping operations in Castle Bromwich, Halewood and Solihull. 

The Solihull body shop, paint shop and logistics centre – which all feed the British car maker’s global operations – will also restart today.

Vehicle manufacturing will “closely” follow this and begin at an unspecific point this week, said JLR.

This will start with the Land Rover Defender and Land Rover Discovery lines at Nitra, Slovakia, and the Range Rover and Range Rover Sport lines at Solihull. 

When production at Halewood will restart is currently unknown, but JLR said further updates “will follow”.

The plant currently builds the Range Rover Evoque and Land Rover Discovery Sport and is being transformed as part of a £500 million project to produce JLR's incoming EVs.

In what state production will restart is as yet unknown, but it is expected to initially be restricted, given that JLR has referred to resumption of operations as a “controlled, phased restart”.

On Tuesday (7 October), JLR also confirmed that it's setting up a new financing scheme to pay “qualifying” suppliers ahead of the production restart in an effort to “aid their cash flow in the near term”. 

Suppliers have struggled during the production shutdown, with some having to lay off staff just to stay in business. Such have been the difficulties that MPs stepped in and committees were set up.

Back to top

“This week marks an important moment for JLR and all our stakeholders as we now restart our manufacturing operations following the cyber incident,” said JLR CEO Adrian Mardell. 

“From tomorrow, we will welcome back our colleagues at our engine production plant in Wolverhampton, shortly followed by our colleagues making our world‑class cars at Nitra and Solihull.

“Our suppliers are central to our success, and today we are launching a new financing arrangement that will enable us to pay our suppliers early, using the strength of our balance sheet to support their cashflows.

“I would like to thank everyone connected to JLR for their commitment, hard work and endeavour in recent weeks to bring us to this moment. We know there is much more to do but our recovery is firmly under way.”​

The cyber attack on 1 September brought all factories to a halt and incapacitated JLR, forcing it to shut down its internal computer systems in an effort to protect data from being stolen.

This resulted in production shutdowns at all of its global plants, created issues with parts ordering and stifled retailers.

 

The consequence of the cyber attack is estimated to have cost JLR £1.5 billion drop in revenue.

Figures released by the firm last week show that, in the three-month period including the September shutdown, sales to dealers plummeted by nearly a quarter to 66,165.

The drop represents the loss of 21,138 cars compared with the same period in 2024.

“It has been a challenging quarter for JLR,” outgoing CEO Adrian Mardell said in a statement. However, he said that sales in July and August had been “in line with our expectations” before the cyber attack.

JLR will present its second quarter financial report in November.

Government to underwrite £1.5bn JLR loan

The restart announcement comes after the UK government said it will guarantee a £1.5 billion loan to JLR, to help it support suppliers who have been hit by the production shutdown.

Back to top

The loan to the Tata-owned car maker will be issued by a commercial bank but will be underwritten by the UK government.

As well as costing JLR an estimated £50 million a week, the cyber attack has badly hit JLR's suppliers. 

It's estimated that around 150,000 people are employed by some 700 British firms that supply JLR, and the UK government had been investigating ways to support them, such as a furlough scheme or loans.

It will instead underwrite a single loan to JLR through the Export Development Guarantee (EDG), with JLR repaying the money over a period of five years. 

Business secretary Peter Kyle said on 27 September that the loan guarantee "will help support the supply chain and protect skilled jobs in the West Midlands, Merseyside and throughout the UK".

Chancellor Rachel Reeves added that the loan would help JLR "support their supply chain and protect a vital part of the British car industry".

Since the attack, JLR has been able to restore some of its IT systems following the and has started paying some of its suppliers.

JLR hack: what happened?

Autocar first reported issues affecting JLR on 1 September, when dealers couldn't register new cars on 'new plate day', traditionally one of the year's busiest for registrations.

Back to top

In an effort to combat the hack, JLR began “shutting down" its systems on 2 September. It has not produced any cars globally since, leading to millions of pounds of lost income.

The extent of the issues meant JLR brought police and cybersecurity experts in to “restart our global applications in a controlled and safe manner”.

During this process, which included an investigation, it was discovered that "some data" was "affected", according to JLR. Those affected will be contacted, the firm said.

It's not officially known what data was taken or if a ransom demand has been made, but it is thought it most likely involves customer data, given the involvement of the police.

Who has claimed responsibility for JLR hack?

On 3 September, a group of hackers calling themselves Scattered Lapsus$ Hunters claimed responsibility for the attack on JLR.

This is the same group that hacked Marks & Spencer in May, causing the British retailer seven weeks of disruption and costing £300 million in lost operating profit.

It claimed to have obtained JLR customer data after exploiting a similar flaw in the car maker's IT system. The claim was made on a Telegram messenger group, where a user linked to the hackers posted a screenshot of what appeared to show JLR's internal system.

A member of the group revealled that a well-known flaw in SAP Netweaver, a third-party software used by JLR, was exploited to access the data.

The US's Cybersecurity and Infrastructure Security Agency warned about the flaw earlier this year. An update for the software was released, but whether JLR applied it is unknown.

It's also not known what data was taken or if a ransom demand has been made of JLR.

Join our WhatsApp community and be the first to read about the latest news and reviews wowing the car world. Our community is the best, easiest and most direct place to tap into the minds of Autocar, and if you join you’ll also be treated to unique WhatsApp content. You can leave at any time after joining - check our full privacy policy here.

Will Rimell

Will Rimell Autocar
Title: News editor

Will is Autocar's news editor.​ His focus is on setting Autocar's news agenda, interviewing top executives, reporting from car launches, and unearthing exclusives.

As part of his role, he also manages Autocar Business – the brand's B2B platform – and Haymarket's aftermarket publication CAT.

Join the debate

Comments
84
Add a comment…
valentinamm22 12 October 2025
When I first received a message from an old classmate, it felt like fate had stepped in to reconnect us after so many years. She was warm and friendly and seemed genuinely happy to catch up. After a few exchanges, she confided in me about a crisis. Everything looked real and convincing, I believed her. Her messages conveyed urgency and desperation. She said the hospital required payment in XRP to cover immediate expenses abroad and without hesitation I agreed to help. In total I sent 19500 dollars worth of XRP thinking I was helping to save someone’s life. But everything changed the moment the transfer was complete. She vanished blocking me on all platforms. My trust was manipulated so thoroughly. In my search for help I came across Muyern Trust Hacker. ( https://wa.link/gtkr07 ) I was skeptical at first. After all how could I trust anyone after what had happened? But desperation pushed me to try. From the beginning their team was empathetic and professional. Within a few days they traced the XRP to a wallet already flagged in several online scams. Muyern Trust Hacker froze the suspicious wallet before the funds could be laundered further. In just under four weeks they achieved something I thought was impossible. I got my 19500 dollars back. The relief was indescribable. ( Tele gr am: muyerntrusthackertech  ) Thanks to their expertise and persistence I not only recovered my money but also a small piece of the trust I had lost.
 
katiedilleno 12 October 2025
If anyone out there is in need of a legit hacker for hire to retrieve stolen crypto coins, get back a password, hack Gmail, social networks, upgrade school grades, and MORE, look no further and contact hackerspytech @ gmail com He helped me tremendously with recouping the digital crypto assets that I lost to a fake Brazilian crypto mining company recently. Spytechacker is always there to help when needed. If I can give the this veritable spytechacker team more stars for job satisfaction, I would because 5 stars are not enough!
ianc4 12 October 2025
I understand how tough it can be to lose money or access to important accounts. That's why I'm happy to share about a reliable hacking expert I've worked with. She's efficient and trustworthy, and I'm truly satisfied with her help.I found her email on Medium and Reddit: recoveryfundprovider@gmail.com  WhatsApp at +44 736-644-5035. She's a kind person who's assisted me several times. Once, she even recovered stolen funds from my budget and Binance TR accounts. Her services are top quality, and I'm so grateful I reached out to her in 2025. If you're dealing with lost cryptocurrencies or Bitcoin accounts, she can help retrieve them. She also handles deleted or old texts, call logs, emails, and photos. Need to access your spouse's social media? She covers Facebook, Twitter, Instagram, Messenger chats, Snapchat, Reddit, and Telegram.
She provides a wide range of legit hacking services. This post is my way of thanking her for great work. If you see this, feel free to contact her.