Beyond the Breach: Understanding the JLR Cyber-Attack & UK's Cyber-Security Battle

The recent cyber-attack on Jaguar Land Rover severely disrupted production, impacting 34,000 UK employees and its extensive global supply chain. The UK Government, via the National Cyber Security Centre (NCSC), is actively supporting JLR and engaging daily with the company. This incident highlights a growing national challenge, with 40% of UK companies reporting cyber-attacks last year. The government is implementing new legislation like the Product Security and Telecommunications Infrastructure Act 2022 and plans a Cyber-security and Resilience Bill to raise standards across critical services. Businesses are urged to use free NCSC tools and schemes like Cyber Essentials to bolster their defences against increasingly sophisticated threats.

Key Takeaways

• JLR's Significant Impact: The cyber-attack halted Jaguar Land Rover's production, affecting its plants in Halewood and Solihull, as well as global facilities and thousands of jobs across its supply chain.
• Government Support: The National Cyber Security Centre (NCSC) has been actively involved in supporting JLR since the incident occurred, and the government is engaging daily with the company and its CEO.
• Broader Threat Landscape: Cyber-attacks are a major national security and economic threat, with 40% of UK companies reporting an attack last year. The UK faces increasingly hostile activity from criminals and state actors.
• Government Initiatives: Current measures include the Product Security and Telecommunications Infrastructure Act 2022 and codes of practice for software and AI cyber-security. A new Cyber-security and Resilience Bill is planned to raise standards in critical services.
• Tools for Businesses: The government offers various tools and advice, such as the Cyber Essentials scheme (reducing cyber insurance claims by 92%), cyber governance code of practice, and free NCSC resources like "Check Your Cyber Security" tools and an early warning system.

Source:  Jaguar Land Rover Cyber-attack
Volume 772: debated on Tuesday 9 September 2025

Follow and subscribe to 'The Bench Report' on Apple, Spotify, and YouTube for new episodes daily: thebenchreport.co.uk

Subscribe to our Substack 

Shape our next episode! Get in touch with an issue important to you - Producer Tom will grab another coffee and start the research!

Email us: thebenchreportuk@gmail.com

Follow us on YouTube,  X, Bluesky, Facebook, Instagram and TikTok! @benchreportUK

Support us for bonus and extended episodes + more.

No outside chatter: source material only taken from Hansard and the Parliament UK website.  

Contains Parliamentary information repurposed under the Open Parliament Licence v3.0....

Transcript

Amy 0:00

Hello and welcome again to The Bench Report, where we discuss recent debates and briefings from the benches of the UK Parliament. A new topic every episode. You're listening to Amy and Ivan.

Ivan 0:15

Today, we're looking at something that caused quite a stir, an urgent question in Parliament, focusing on that cyber attack against Jaguar Land Rover.

Amy 0:24

Yes, a really significant event. And the impact was, well, pretty much immediate and quite severe.

Ivan 0:31

It sounds like it. Production lines halted, sales completely stopped.

Amy 0:35

That's what the reports indicate. And you have to think about the knock-on effects. We're talking, what, some 34,000 UK employees?

Ivan 0:41

Huge numbers. And then there's the whole supply chain, especially across the West Midlands and the Northwest.

Amy 0:45

Exactly. It ripples out. And the reported figure for lost sales, 72 million pounds per day.

Ivan 0:52

72 million. That really brings home how quickly a digital attack hits the physical economy. Must create a lot of anxiety for workers, for businesses.

Amy 1:01

Absolutely. Understandable anxiety. The government's response seems to have been quite rapid, though.

Ivan 1:05

What are we seeing there? Well, daily engagement with JLR, apparently. Direct support from the National Cyber Security Center, the NCSC, since last Wednesday.

Amy 1:14

Okay, so hands-on help.

Ivan 1:15

Yes. And the minister responsible has apparently had personal meetings with JLR's CEO.

Amy 1:21

Of course, they can't reveal everything, can they? Not while investigations are live.

Ivan 1:25

No. Operational details are understandably limited. But the message is clear. They're committed to helping resolve it. It's being treated as a serious economic issue, not just a tech problem.

Amy 1:38

Which it is. So that's the immediate response. But what about preventing this sort of thing? What wider measures are in place or coming?

Ivan 1:45

Good question. There's existing legislation, the Product Security and Telecommunications Infrastructure Act from 2022, for instance.

Amy 1:52

What does that do, essentially?

Ivan 1:53

It mandates security by design for internet-connected products. So building security in from the ground up rather than adding it later. Think secure foundations, not just alarms on the doors.

Amy 2:04

Makes sense. And the NCSC, they do more than just react, presumably.

Ivan 2:07

Oh, definitely. They offer a whole range of tools and advice. Their cyber essentials scheme, for example, is meant to be high Reducing

Amy 2:17

the likelihood quite drastically, I heard.

Ivan 2:20

That's the aim. Plus, they offer training for boards, for staff, early warning systems to flag potential threats on networks.

Amy 2:27

And there's new legislation on the horizon, too.

Ivan 2:29

Yes, the upcoming Cybersecurity and Resilience Bill. That's intended to raise standards, especially in critical services. Energy, water, the NHS, places you really don't want falling victim.

Amy 2:41

And updating older laws, like the Computer Misuse Act. That's from 1990. It is.

Ivan 2:47

Trying to apply laws from the dial-up era to modern cyber threats is challenging, to say the least. The landscape has changed entirely.

Amy 2:55

Especially with things like ransomware, which keeps cropping up.

Ivan 2:58

A major issue. And the government's stance there is quite firm. They advise against paying ransoms.

Amy 3:03

Why is that, specifically?

Ivan 3:05

Because paying essentially validates the criminal's business model. It encourages more attacks. The focus has to be on prevention, resilience, and catching the perpetrators.

Amy 3:14

It's a tough line to hold though, isn't it? If you're a company hemorrhaging millions, like that 72 million pound a day figure for JLR, the pressure must be immense.

Ivan 3:24

It's incredibly difficult. There's definitely a tension between that long-term policy goal and the immediate commercial survival instinct.

Amy 3:31

And this JLR incident, it's not happening in a vacuum, is it?

Ivan 3:34

Not at all. It's part of a much bigger picture. We've seen other major British names hit recently. Marks & Spencer, even the British Library, had significant issues.

Amy 3:41

That statistic was quite eye-opening. Something like 40% of UK companies reported some kind of cyber attack last year.

Ivan 3:48

Around that figure, yes, 40%. It shows this isn't just about the huge corporations, small, medium businesses. Everyone is potentially a target.

Amy 3:57

And the threat itself, is it getting worse and more sophisticated?

Ivan 4:00

The evidence points that way. Increasingly hostile activity comes from sophisticated criminal groups, but also potentially from malicious state actors. And it's a global issue. Qantas, Adidas, big international names facing similar problems.

Amy 4:15

Is there a sense that maybe companies sometimes focus security efforts in the wrong place?

Ivan 4:19

Well, there's an interesting point raised sometimes that companies might understandably prioritize protecting customer data, credit cards, personal info, maybe sometimes at the expense of securing their core operational systems, the systems that actually run the factory or the logistics.

Amy 4:36

Leaving the core business vulnerable, even if customer details are safe. That's a critical distinction.

Ivan 4:42

It is. It underlines that this is fundamentally a national security issue and an economic one. It affects every single sector.

Amy 4:48

And looking forward, there's this idea of computers on wheels, future cars.

Ivan 4:53

Exactly. As vehicles become more connected, more autonomous, they potentially become targets, too. It adds a whole new dimension. Not just data theft, but potential physical disruption, even safety risks.

Amy 5:04

A sobering thought. It really demands constant vigilance, constant adaptation from businesses, from government, from all of us, really.

Ivan 5:11

Precisely. Proactive defense, built-in security, awareness As always, find us on social

Amy 5:21

media at BenchReportUK. Get in touch with any topic important to you. Remember, politics is everyone's business. Take care.