What the JLR cyber attack taught mid-sized manufacturers about supply-chain risk
The JLR attack showed that a manufacturer can lose weeks of output without being hacked itself. When one large customer stops, orders, cash and shifts stop down the chain. The lesson for a mid-sized firm is to plan for three outages: your customer’s, your supplier’s and your own. And be ready to prove your basics.
What happened at JLR, and why did it hit suppliers so hard?
JLR announced a cyber incident on 2 September 2025 and shut down its global systems. UK car production stopped for about five weeks, restarted in phases from 8 October and, according to JLR, was back to normal levels by mid-November. Suppliers build to JLR’s schedules, so their orders and income stopped too. The attack was on JLR. Suppliers were hit through lost orders, not through their own systems.
The numbers are worth knowing:
- The Cyber Monitoring Centre (CMC), an independent body, estimated the UK cost at £1.9bn (a modelled range of £1.6bn to £2.1bn), across more than 5,000 UK organisations. It said the incident “appears to be the most economically damaging cyber event to hit the UK”.
- JLR relies on nearly 1,000 tier-one suppliers and thousands more at tiers two and three (same source).
- JLR booked £196m of cyber-related exceptional costs in the quarter to 30 September 2025, and a further £64m in the quarter to 31 December 2025.
- A month into the shutdown, the Guardian reported that banks had asked some small suppliers to put up their family homes as personal guarantees for emergency loans.
- On 28 September 2025 the government agreed a loan guarantee, through UK Export Finance, expected to unlock up to £1.5bn of commercial lending to JLR to support its supply chain. JLR also fast-tracked a £500m financing scheme so qualifying suppliers could be paid earlier.
The CMC found that the vast majority of the loss came from lost manufacturing output at JLR and its suppliers, not from stolen data. That’s the point for a mid-sized manufacturer. The risk that costs most is disruption, and disruption travels along the supply chain.
Is supply-chain cyber risk really an issue for a 200-person manufacturer?
Yes. Make UK’s 2026 survey found that 30% of UK manufacturers had a serious cyber incident in the past year, either directly or through their supply chain. Of those affected by an attack on a supplier, 31% had delays to customer deliveries and 31% lost production capacity. What matters is who you depend on, not how big you are.
Other findings from the Make UK report (PDF):
- 23% had shortages of components or materials after a supplier was attacked.
- 25% have been asked by a customer to show cyber security compliance, and 23% now ask the same of their own suppliers.
- 16% don’t know whether they have cyber insurance.
The government’s latest survey shows how rarely this gets looked at formally. 65% of medium businesses (50 to 249 staff) reported a breach or attack in the last 12 months, but only 30% reviewed the cyber risks posed by their immediate suppliers (DSIT Cyber Security Breaches Survey 2025/2026). Across all businesses, just 6% looked at their wider supply chain.
What should you plan for if a major customer goes down?
Treat a customer’s outage as a cash-flow and continuity event, not an IT event. Know how much revenue depends on each customer, how many weeks you could pay wages without orders, what your insurance actually covers, and who you’d call first. Write it down now, while it’s a planning exercise rather than a crisis.
The CMC made three recommendations that apply directly to suppliers:
- Check revenue concentration. Suppliers should assess how much revenue relies on one ultimate customer, and keep liquidity buffers or other plans for an extended shutdown.
- Read your insurance wording. The CMC notes that typical policies cover your own losses and supplier failure, but disruption at a critical buyer or customer can be out of scope. Ask your broker that exact question.
- Know which systems matter. Boards should identify the critical digital assets the business needs, challenge “what if this is compromised?” scenarios, and have recovery plans ready.
A simple table puts it in front of the board on one page:
| Scenario | First question | Who owns it |
|---|---|---|
| Your largest customer stops ordering for six weeks | How many weeks of cash do we have? | MD and finance |
| A key supplier’s systems go down | Do we have another source or a stock buffer? | Operations and purchasing |
| Your own ERP or network is unavailable | How long to restore, and have we tested it? | IT, in-house or provider |
| A customer asks for proof of your controls | Can we send evidence this week? | IT and quality |
How do you check the suppliers your production depends on?
Start with the few suppliers that could stop your line, not all of them. List who supplies critical parts, who can connect to your systems remotely, and who holds your data. Then ask each one a short, proportionate set of questions, and accept recognised evidence such as Cyber Essentials instead of sending a long bespoke questionnaire.
A practical order of work:
- Map dependencies. Parts, logistics, software and IT providers, and machine builders with remote access. Make UK’s first recommendation is to map the systems and suppliers that keep the factory running.
- Rank by impact. Which ones would stop production within a week?
- Ask a few clear questions. Do they have a tested recovery plan? Who can connect to our network, and how? Will they tell us quickly if they’re hit?
- Use existing schemes. The NCSC’s supply chain guidance sets out 12 principles, and its Cyber Essentials supply chain playbook shows how to use Cyber Essentials as a proportionate baseline for suppliers.
- Control remote access. Supplier accounts should be named, limited to what they need, and switched off when they’re not in use.
What will your customers ask you to prove?
Expect more questionnaires, more requests for Cyber Essentials and tighter contract clauses. A quarter of manufacturers have already been asked to show compliance. The baseline also got stricter in April 2026. For Cyber Essentials assessments opened after 26 April 2026, missing MFA on cloud services, or high-risk and critical updates not installed within 14 days, mean an automatic fail.
The IASME update also says systems must be supported on the date the certificate is issued, and any excluded networks must be justified and shown to be segregated. If you sell into defence, aerospace or automotive, check what your customers’ contracts now say and when they want evidence.
The firms that handle these requests most easily already keep the evidence: an asset list, patch reports, a record of a backup restore and a named owner. The same evidence is what helps you recover.
Key takeaways
- The CMC estimates the JLR attack cost the UK £1.9bn, mostly lost output at JLR and its suppliers, not stolen data.
- 31% of manufacturers hit by an attack on a supplier had delays to customer deliveries (Make UK, 2026).
- Only 30% of medium UK businesses review their immediate suppliers’ cyber risk (DSIT, 2025/2026).
- Plan for a customer’s outage as a cash-flow event, and check what your insurance covers.
- Keep evidence of your basics ready. Customers are already asking for it.
Frequently asked questions
What was the JLR cyber attack?
JLR announced a cyber incident on 2 September 2025 and shut down its global IT systems. UK production stopped for about five weeks, restarted in phases from 8 October 2025 and returned to normal by mid-November. The Cyber Monitoring Centre, an independent body, estimated the UK cost at £1.9bn across more than 5,000 organisations.
How did the JLR attack affect suppliers?
Suppliers lost orders and income while JLR’s production was stopped. The Cyber Monitoring Centre reported severe cash-flow pressure across the multi-tier supply chain, and the Guardian reported that banks asked some small suppliers to put up their homes as personal guarantees for emergency loans.
Does cyber insurance cover a customer’s cyber attack?
Often not. The Cyber Monitoring Centre notes that typical policies cover your own losses and supplier failure, but disruption at a critical buyer or customer can be out of scope. Ask your broker specifically about customer-side disruption before you rely on your policy.
What cyber security do customers expect from suppliers?
Cyber Essentials is the UK government-backed baseline, and the NCSC recommends it as the minimum standard for organisations of all sizes. For assessments opened after 26 April 2026, missing MFA on cloud services, or high-risk and critical updates not installed within 14 days, mean an automatic fail.
If customers are starting to ask you for Cyber Essentials, it helps to know where you stand before you apply. Our CTO runs a free Cyber Essentials readiness check.
Book a free Cyber Essentials readiness check
