INSIGHTS
Jaguar Land Rover, 1.9 billion pounds: five weeks of shutdown without a policy
On 1 September 2025 an attack stopped Jaguar Land Rover's factories for five weeks, with an estimated cost of 1.9 billion pounds to the UK economy and more than 5,000 businesses affected. The analysis: the production outage, the supplier chain, the cost of not being insured and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, September 2025 · by cybercoverinsurance
On 1 September 2025 Jaguar Land Rover detected a cyber attack and shut down all its systems globally. Assembly lines in the UK, Slovakia, Brazil and India stopped for five weeks. The Cyber Monitoring Centre estimated the cost to the UK economy at about 1.9 billion pounds, the highest ever recorded in the country, with more than 5,000 businesses affected. The government guaranteed a 1.5 billion pound loan. According to the insurance press, the company had no cyber policy in force.
For cyber underwriters the case is the reference point for two themes: interruption in manufacturing with a long supplier chain, and the cost of not being insured. It shows what a production outage scenario lasting weeks is really worth, and what happens when nobody has transferred it.
What is known
The attack and the outage. JLR disclosed the incident on 2 September 2025: its first step was to shut down all global systems. Production resumed in phases from 8 October. In the July-September quarter revenue fell 24% to 4.9 billion pounds, with a loss before tax and exceptional items of 485 million and 196 million of exceptional costs linked to the attack. JLR set up a 500 million financing scheme to pay qualifying suppliers as soon as production is scheduled (JLR).
Attribution. The group calling itself Scattered Lapsus$ Hunters claimed the attack. It is described as a criminal group made up mainly of Western teenagers (GovInfoSecurity).
The cost to the economy. The Cyber Monitoring Centre estimated the cost to the UK economy at about 1.9 billion pounds, in a range of 1.6 to 2.1 billion, with more than 5,000 UK businesses reporting losses. The estimate could rise if the systems controlling the lines had been damaged. In September the government guaranteed a 1.5 billion pound loan, to be repaid within five years (GovInfoSecurity).
Insurance. According to Insurance Business, JLR was negotiating a cyber policy through broker Lockton, but the contract had not been concluded when the attack hit, and no insurer bore any part of the loss. The incident's exceptional costs reached almost 260 million pounds by February 2026 (Insurance Business).
What is not known. How the attackers got in, whether a ransom was demanded or paid, and whether production systems were damaged have not been made public. JLR has not publicly confirmed the status of its cover.
The outage is worth more than the system
Five weeks of stopped lines. The IT side of the incident is measured in days of recovery. The economic side is measured in cars not built. With quarterly revenue between 5 and 7 billion pounds, each week of outage weighs hundreds of millions. The quarter's 196 million of exceptional costs are only part of the loss: the rest sits in the operating loss.
The choice to shut everything down. JLR shut down all global systems as its first measure (JLR). It is a prudent choice to contain the attack, but it turns a cyber incident into a total outage. For underwriters, the insured's response plan decides the length of the interruption as much as the attack itself.
Phased recovery lengthens the indemnity period. Production resumed from 8 October in phases, returning to normal levels only later (JLR). An indemnity period based on the restoration of systems, rather than the return to normal volumes, leaves the tail of the loss uncovered.
The supplier chain
Five thousand businesses hit without being attacked. According to the Cyber Monitoring Centre, more than 5,000 UK businesses reported losses (GovInfoSecurity). For component suppliers that depend on JLR, no orders means no income. For them the loss is a dependent interruption caused by a customer, not by an IT supplier.
The supplier's policy often does not respond. Dependent business interruption covers usually concern the insured's IT service providers, sometimes named suppliers. A large customer's outage rarely falls within them. For many small firms in the chain the loss probably stayed uncovered, and JLR set up financing to bring forward payments to suppliers.
The customer as an aggregation point. A portfolio of small and medium manufacturers can be concentrated on a few large customers. An event like JLR hits them all together. Data on insureds' main customers is rarely collected.
The cost of not being insured
The loss stayed with the group and the state. Without a policy, the costs were absorbed by JLR, its parent and, for liquidity, a government-guaranteed loan. Ciaran Martin, chair of the Cyber Monitoring Centre's technical committee, called it an unfortunate precedent (Insurance Business). Public support after an attack can reduce the incentive to insure.
Capacity existed, at least in part. Marks & Spencer, hit a few months earlier, could claim up to 100 million pounds on its policy against a 300 million impact. No policy would have covered 1.9 billion, but cover of a few hundred million would have reduced the retained part. The JLR case is the extreme version of the same gap.
An unfinished negotiation is a risk. According to Insurance Business, the policy was being negotiated. For brokers and insurers, long negotiation times for large groups' covers leave windows without protection, which should be managed with temporary cover or by extending existing policies.
What to bring to renewals
Impact for insurersHigh
An attack on a car maker stopped production for five weeks, with an estimated cost of 1.9 billion pounds to the UK economy and more than 5,000 businesses affected, without a cyber policy in force according to the press.
On the portfolio side, the JLR case suggests mapping supply chains: how many insureds depend on the same large customer or the same plant. A five-week outage scenario at a large manufacturer, with effects on hundreds of small suppliers, is a useful test for aggregate limits and dependent business interruption covers.