The cyberattack on Jaguar Land Rover (JLR) in late August 2025 became one of the most economically significant cyber incidents in UK corporate history. Vehicle production at several UK sites stopped for around five weeks while the company contained the incident and restored its systems.
What was reported
As reported at the time, based on JLR's own quarterly results and official UK statistics:
- JLR disclosed around £196 million of cyber-related costs for the quarter, and a quarterly loss after a profit in the same period a year earlier.
- UK output data for September 2025 showed a sharp fall in vehicle manufacturing, and the production halt was cited as a significant factor in a monthly fall in GDP.
- Independent estimates put the wider cost to the UK economy, including suppliers, well above JLR's own direct costs.
Figures here are as publicly reported in November 2025. Readers should refer to JLR's published results and the Office for National Statistics for the exact numbers.
Why the supply chain felt it
JLR sits at the top of a deep supplier network. When its lines stopped, orders to suppliers, logistics firms and local businesses stopped with them. For smaller suppliers, several weeks without orders from a major customer can threaten their survival, which is why government support for the supply chain was discussed.
What recovery does not cover
JLR, like other large manufacturers, invests in monitoring, segmentation, endpoint protection, backups and access control. Those controls are essential, and they are what brings operations back. But they answer questions about systems: how the attacker got in, whether they are still there and how to restore service.
A separate question often remains open after systems are restored: what can be done with the data that was copied before the incident was contained? Customer records, supplier contracts and design files can keep their value to an attacker long after the factory restarts. The usual working assumption is that once data has left, control has been lost.
Where post-breach data control fits
PastWipe™ is built for that stage. For selected high-value data, it attaches policy to the data and re-checks conditions each time the data is used:
- Policy: who may use the data, on which devices and environments, for what purpose and for how long.
- Validation at the point of use: when conditions no longer hold, for example after an incident is declared, use can be denied, restricted or degraded.
- Evidence records: each decision is recorded, so security, legal and insurance teams can see what was requested and what was allowed or denied.
PastWipe reduces the usable value of stolen copies outside approved conditions and gives organisations evidence of the controls they had in place. It works alongside breach prevention; copies that have already become unrestricted plaintext, and photographs of a screen, are outside enforcement.
Questions for boards
- Which of our datasets would still be valuable to an attacker after we have recovered our systems?
- Could we show a regulator or insurer what happened to requests for that data after an incident?
- Which of our suppliers hold our sensitive data, and under what conditions?
How PastWipe works · Scope an evaluation
All insights and news · Get the quarterly Post-Breach Briefing