CyberCQR Thinking · JLR one year on

The breach you can't patch: when your customer goes down

A year ago, thousands of UK firms stopped earning money because of a cyber attack on someone else's network. Supply chain risk runs both ways, and most boards only look in one direction.

19 October 2026 · Version 1.0 · Reading time about 7 minutes

Summary

£1.9bnEstimated cost to the UK economy (range £1.6bn to £2.1bn)

5,000+UK organisations affected

~5 weeksVehicle production suspended

Cat 3Systemic event, on a five-point scale

All four figures: Cyber Monitoring Centre statement, October 2025.

The point for boards. Most of the firms hit by the JLR attack were never breached. Their own controls held, and it made no difference. Their exposure was a customer's systems, their cash runway and their contract terms. None of those sit with the IT team.

What happened

JLR shut down its global systems after a cyber attack at the start of September 2025. Vehicle production stayed suspended for around five weeks. It restarted in phases from 8 October, as set out in JLR's Q2 FY26 results statement. The Cyber Monitoring Centre modelled a gradual return to full production by early January 2026.

Table 1. Timeline of the incident and response (chronological)
Date	Event	Source
Late August 2025	Cyber attack on JLR.	[1]
Early September 2025	JLR shuts down its global systems. Vehicle production stops.	[2], [4]
15 September 2025	Unite warns that thousands of supply chain workers are at risk and that some suppliers have started layoffs. It calls for a furlough-style support scheme.	[4]
28 September 2025	UK Government announces a £1.5bn loan guarantee through UK Export Finance, to help JLR pay suppliers and restore its supply chain.	[3]
8 October 2025	Phased restart of manufacturing begins.	[2]
22 October 2025	Cyber Monitoring Centre puts the UK cost at £1.9bn and rates the attack a Category 3 systemic event.	[1]
October 2025	Industry figures show UK car production in September 2025 at its lowest September level in more than 70 years.	[10]
November 2025	JLR reports £196m of cyber-related costs for the quarter, revenue down 24% to £4.9bn, and a £500m financing scheme to give qualifying suppliers cash upfront during the restart.	[2]
Early January 2026	Return to full production, as assumed in the Cyber Monitoring Centre model.	[1]

Where the cost landed

JLR's own costs were large: £196m in one quarter, according to its results. But the Cyber Monitoring Centre estimate of £1.9bn is a whole-economy figure. It says most of the loss came from lost manufacturing output at JLR and its suppliers. It then traces the rest through dealers, logistics firms and the high street.

Table 2. Who carried the loss (alphabetical)
Group	How they were hit
Dealerships	Lost sales margin because there were fewer cars to sell.
JLR	Lost manufacturing output, plus £196m of incident costs in Q2 FY26.
Local businesses	Lower spending in the local economy as household incomes fell.
Service, transport and export firms	Delayed shipments and less work.
Tier 1, 2 and 3 suppliers	Lost profit, and fixed costs that kept running with no revenue to cover them. The Cyber Monitoring Centre reports severe cash flow problems, and at least one supplier taking out a personally backed loan.

Source: Cyber Monitoring Centre statement [1], with JLR figures from [2]. The estimate excludes overseas operations, data breach costs and any ransom payment.

The scale of the dependency matters. JLR indirectly supports at least 100,000 jobs across its suppliers, according to reporting at the time. Two of the biggest support measures, the £1.5bn government-backed loan and JLR's £500m supplier financing scheme, were aimed at getting cash to the supply chain. That tells you where the pressure was.

Supply chain risk runs both ways

Most supply chain security work looks upstream. It asks what happens if a supplier is breached, or if a supplier's weakness becomes ours. That is the right question, and the guidance covers it well.

The JLR suppliers faced the downstream version. Their customer was breached and their revenue stopped. Nothing on their own network changed. A strong security programme would not have helped them, because the risk was never in their systems.

Your security controls can be excellent and still leave you exposed to this.

The main frameworks treat this downstream risk unevenly. Some name it. Others leave it to interpretation. Table 3 shows where boards can find it.

Table 3. How the main UK and international references treat downstream (customer) dependency (alphabetical)
Reference	What it asks	Covers customer dependency?
Cyber Governance Code of Practice, Action A.4	Boards gain assurance that the organisation is resilient to cyber risk from its supply chain and business partners.	Yes, if a major customer is treated as a business partner. The wording allows it.
Cyber Governance Code of Practice, Action D.2	At least annual exercising of the incident plan, involving internal and external stakeholders.	Yes, if exercises include a scenario where a key customer is the one hit.
ISO 22301:2019 (business continuity)	Business impact analysis of prioritised activities and the resources they depend on.	Yes, if the analysis treats customer revenue as a dependency, not just suppliers and systems.
NCSC Cyber Assessment Framework v4.0, Principle A4	Understand and manage risks that arise from dependencies on suppliers.	No. It looks upstream only.
NIST Cybersecurity Framework 2.0, GV.OC-05	Outcomes, capabilities and services that the organisation depends on are understood and communicated.	Yes. The wording is broad enough to cover customers.
NIST Cybersecurity Framework 2.0, GV.SC	Cyber supply chain risk management for suppliers and third parties.	Mainly upstream.

Regulation is moving towards wider dependencies. The Cyber Security and Resilience (Network and Information Systems) Bill is still in the House of Lords and has not become law. Clause 12 would let regulators designate critical suppliers to essential services. Like most of the guidance, it looks upstream. Customer dependency remains a matter for each board.

The exposure test

We use four areas to test how exposed a business is to a cyber incident at a customer. Each one is a question the board can answer without any technical knowledge.

Table 4. Board exposure test for downstream cyber risk (alphabetical)
Area	Question for the board	What good looks like	Warning sign
Cash runway	How many weeks of payroll and fixed costs can we carry with no money coming in from our largest customer?	A known number of weeks, reviewed with the finance plan, and longer than a realistic recovery time.	Nobody can give the number, or it is shorter than five weeks.
Contract terms	What happens under our contracts if a customer cannot take delivery or pay on time because of a cyber incident?	Clear terms on payment for work done, cancelled orders and force majeure. Legal advice on how they would apply.	Force majeure lets the customer suspend orders, but nothing covers our costs.
Customer concentration	What share of our revenue depends on one customer's systems staying up?	Concentration is measured, reported to the board and inside an agreed tolerance.	One customer, or one group of linked customers, accounts for a large share of revenue and nobody tracks it.
Insurance	Does our cover pay out if we lose income because a customer is hit, not us?	The board has asked the broker this question directly and has the answer in writing.	The cyber policy covers our own incidents only. The Cyber Monitoring Centre notes that current products typically cover the insured's direct losses and may exclude disruption to critical customers.

Five questions for your next board meeting

Which customers, if they stopped ordering for a month, would put our ability to pay staff at risk?
How many weeks could we keep going without that customer's payments, and who owns that number?
Have we read our largest contracts with a customer cyber incident in mind?
Has our broker confirmed in writing whether we are covered for a loss that starts on a customer's network?
Does our incident exercise include a scenario where we are the one waiting for someone else to recover?

Conclusion

The JLR attack was not only a story about one company's security. It was a story about dependency. The firms that suffered most had done nothing wrong on their own networks. They were exposed because a single customer, a thin cash buffer and untested contract terms all met at the same moment.

Security is the outcome, not a solution. Here, the outcome depends on decisions about customers, cash and contracts, and those decisions belong to the board.

Has your board ever modelled losing your largest customer for a month?

Glossary

Table 5. Terms used on this page (alphabetical)
Term	Meaning
Business impact analysis	A structured assessment of which activities matter most, what they depend on, and how long the business can cope without them.
Cash runway	How long a business can meet payroll and fixed costs from cash and available credit, with reduced or no income.
Category 3 systemic event	The Cyber Monitoring Centre's rating for a cyber event with wide economic impact, on its five-point scale.
Customer concentration	The share of revenue that comes from one customer or a small group of customers.
Downstream dependency	Reliance on customers, and on their systems staying up, for revenue.
Force majeure	A contract term that excuses a party from its obligations when events outside its control stop it performing.
Tier 1, 2 and 3 suppliers	Tier 1 suppliers sell directly to the manufacturer. Tier 2 suppliers sell to tier 1, and tier 3 to tier 2.
Upstream dependency	Reliance on suppliers and service providers to deliver what the business needs.

References

[1]Cyber Monitoring Centre, Statement on the Jaguar Land Rover Cyber Incident, 22 October 2025.
https://cybermonitoringcentre.com/2025/10/22/cyber-monitoring-centre-statement-on-the-jaguar-land-rovercyber-incident-october-2025/
[2]JLR, JLR Performance Impacted in Challenging Quarter (Q2 FY26 results), November 2025.
https://media.jlr.com/corporate/news/2025/11/jlr-performance-impacted-challenging-quarter
[3]BleepingComputer, UK govt backs JLR with £1.5 billion loan guarantee after cyberattack, 29 September 2025.
https://www.bleepingcomputer.com/news/security/uk-govt-backs-jlr-with-15-billion-loan-guarantee-after-cyberattack/
[4]The Register, Jaguar Land Rover supply chain workers must get Covid-style support, says union, 15 September 2025.
https://www.theregister.com/2025/09/15/covidstyle_furlough_schemes_for_jlr/
[5]Department for Science, Innovation and Technology and NCSC, Cyber Governance Code of Practice, 8 April 2025.
https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
[6]NCSC, Cyber Assessment Framework v4.0, Principle A4: Supply Chain, reviewed 6 August 2025.
https://www.ncsc.gov.uk/collection/cyber-assessment-framework/caf-objective-a-managing-security-risk/principle-a4-supply-chain
[7]NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024.
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
[8]ISO, ISO 22301:2019 Security and resilience: Business continuity management systems: Requirements, with Amendment 1:2024.
https://www.iso.org/standard/75106.html
[9]UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill, bill progress page, checked 19 October 2026.
https://bills.parliament.uk/bills/4035
[10]Euronews, Cyberattack drives UK car production to 73-year low as tax threat looms, 24 October 2025.
https://www.euronews.com/business/2025/10/24/cyberattack-drives-uk-car-production-to-73-year-low-as-tax-threat-looms

Security is the outcome, not a solution.

CyberCQR is a UK cybersecurity advisory practice. We help boards understand where their real exposure sits, including the risks that never touch their own network.

www.cybercqr.com