Cybersecurity
JLR to restart car production following cyberattack as supply chain impact emerges
JLR has announced that it is preparing to restart car production in the wake of a disruptive cyber incident; meanwhile, the UK government has offered support to JLR's supply chain as suppliers grapple with the fallout from the halt in production.
JLR first announced on September 2, 2025 that it had been forced to shut down its global IT systems after a cyber incident, leading to a halt in production. Then on September 23, it informed colleagues, suppliers and partners that this pause in production would be extended until October 1. Now, it is gearing up to restart production, but for some in the supply chain the impact has already been felt.
To mitigate this disruption, the UK Department for Business and Trade has announced that it will support JLR with a £1.5 billion ($2 billion) loan to “give certainty to its supply chain” in the wake of the cyber incident. “Following our decisive action, this loan guarantee will help support the supply chain and protect skilled jobs in the West Midlands, Merseyside and throughout the UK,” business and trade secretary Peter Kyle said.
“Providing support directly to supply chain firms is actually tricky as JLR didn’t have much of a map of the supply chain beyond its first- and second-tier suppliers,” said David Bailey, professor of business economics at the Birmingham Business School. This lack of a complete map of its supply chain could make distributing support difficult, even with financial support from the government.
“The SMMT Forum has been working with the firm to build a better picture. Guaranteeing a loan via JLR gets cash into the supply chain but ensuring that the cash cascades down the supply [chain] will be vital,” Bailey added.
Advertisement
Ripples through the supply chain
Shutting down production for weeks hasn’t just affected JLR, but also its partners and suppliers. With JLR operating three factories in the West Midlands, a recent snap survey of 84 businesses conducted by the Black Country, Greater Birmingham and Coventry and Warwickshire Chambers of Commerce found that 77% had been negatively impacted by the cyberattack.
As a result, 35% reported that they’d already reduced staff hours or asked staff not to work temporarily, while 14% were already in the process of making redundancies.
“The Black Country's automotive supply chain employs 13,000 people so the ripple effects of this cyber-attack are being felt right across our business community,” said Sarah Moorhouse, chief executive of the Black Country Chamber of Commerce. “What these initial survey results show is that this isn't just about JLR – it's about the suppliers, manufacturers and service providers that make the Black Country the powerhouse of UK automotive production.”
One company in the area which has felt the effects of the shutdown is Walsall-based press work company Genex UK, a small firm with 17 employees which provides parts for several tier 1 JLR suppliers. “We’ve kept working, building some stock to keep our employees in work, but we’ve run out of space and material,” explained Michael Beese, managing director of Genex UK. “I have now laid off staff due to the uncertain short-term future.”
And it’s not just the West Midlands that will have been affected. Suppliers around the UK and globally will have been struggling with the same issues since the cyber incident. According to the Confederation of British Metalforming (CBM), the government’s loan guarantee is not being rolled out quickly enough to reach suppliers struggling further down the supply chain. “We need to find a way to get money quickly to where it is needed most, to prevent the supply chain from completely collapsing,” CBM president Stephen Morley said.
Employee impact
A major concern has been the job security of JLR employees, and those in its wider supplier chain that will have been affected by the halt in production. JLR employs around 40,000 people worldwide and already announced that 500 management jobs would be cut in the UK prior to the cyber incident. This announcement came in July, as the company revealed its profits had almost halved due to the impact of US tariffs.
On September 17, before the announcement of the government’s loan to support JLR, trade union Unite issued a statement claiming that workers throughout the JLR supply chain are being laid off with reduced or zero pay, with some being advised to sign up for universal credit. “Workers in the JLR supply chain must not be made to pay the price for the cyberattack,” said Sharon Graham, general secretary of Unite.
After the loan was announced, Unite’s Graham responded: “This is an important first step and demonstrates that the government has listened to the concerns raised in meetings with Unite over recent days. This is exactly what the government should be doing, taking action to protect jobs.”
She added: “The money provided must now be used to ensure job guarantees and to also protect skills and pay in JLR and its supply chain.”
Restarting operations
JLR’s most recent statement regarding the cyber incident outlines a “controlled, phased restart” of operations, with some sections of its manufacturing operations expected to resume “in the coming days”. The firm said it continues to “work around the clock alongside cybersecurity specialists, the UK Government’s NCSC and law enforcement to ensure our restart is done in a safe and secure manner.”
Professor Bailey at the Birmingham Business School has said that while engine production at JLR’s i54 plant – as well as invoice processing and car registrations with the DVLA – are set to restart, car manufacturing has not yet restarted and “that still leaves some suppliers in a very difficult position indeed.”
“A key lesson in all of this is to have a policy toolkit available to be drawn on ‘off the shelf’ in response to major shocks, using actions like loan guarantees,” Bailey added. “That was a key finding from our work on MG Rover in the wake of its 2005 collapse, and during the financial crisis.”
