- OperationsA phased restart had to bring production and its dependencies back together.
- SuppliersDelayed or cancelled orders affected schedules, staffing and payments.
- DealershipsSystems were intermittently unavailable and the disruption reached retail operations.
Over 5,000 UK organisations affected in the Cyber Monitoring Centre’s model. The estimate spans JLR and other businesses in the network.
The question “what did it cost?” has more than one answer after a serious cyber incident. A company accounts for its own costs in a reporting period. Its suppliers and customers experience disruption in theirs. A wider estimate tries to describe how the event travelled through the economy. Jaguar Land Rover’s 2025 incident gives us an unusually clear example of each scope.
Follow the reporting dates
The incident began in late August 2025. JLR shut down systems and paused production during its response. The Cyber Monitoring Centre published its UK estimate on 22 October, while recovery was still underway. JLR published results for the quarter ended 30 September on 14 November, identifying £196 million in cyber-related exceptional costs. These dates explain why the figures describe different observations at different points. JLR · Quarterly results, 14 November 2025 · Cyber Monitoring Centre · JLR impact model, October 2025
| Measure | How to read it |
|---|---|
| £196m | JLR’s reported cyber-related exceptional costs in Q2 FY26. A company reporting figure for the quarter. |
| £1.9bn | CMC’s modelled UK-wide financial impact, with a range of £1.6bn–£2.1bn. The model includes JLR and other affected organisations. |
| Over 5,000 organisations | The model’s estimate of UK organisations affected. The impact can vary widely between businesses. |
The measures overlap in economic scope and differ in method. Adding them would give a total with no coherent meaning. The model depends on assumptions about when production resumes, how quickly it ramps up and what disruption follows for other firms. The reported exceptional costs are a particular financial reporting line, rather than a valuation of every commercial consequence. Cyber Monitoring Centre · JLR impact model, October 2025
Why the disruption crossed company boundaries
A supplier plans labour and purchases around orders. A production stoppage can leave it with stock, a changed schedule and a different date for payment. Dealership systems were also intermittently unavailable, according to the CMC. That creates disruption beyond the factory and beyond the organisation that first responded to the attack. The NCSC’s case study describes pressure on schedules, orders and payments. NCSC Annual Review 2026 · JLR case study
The distinction matters in both directions. A business can lose access to a key supplier or find that a major customer pauses work. In either case the commercial exposure depends on which commitments can be moved, replaced or recovered later.
Reforecast at the level of a business service
For an illustrative example, imagine a supplier completes work but cannot get acceptance while its customer’s systems are down. The receipt may arrive later, and the supplier may still pay staff and meet its own obligations this week. If the order is cancelled entirely, the loss of trade is a separate consequence. Specialist response or temporary processes create extra expenditure again.
Use the dates when work can be accepted, invoices can be issued and collections can resume to revise a cash forecast. Keep incident spend separate from those timing changes. The NCSC’s recovery guidance describes modelling different recovery options and updating assumptions as services come back. NCSC · Recovery and ongoing investigations
This case can help a leadership team identify which dependencies deserve a continuity plan. Its figures belong to the incident and its modelled network. See the leadership dependency analysis and the finance cash-flow timeline.
