Jaguar Land Rover cyberattack cost $2.5 billion, says monitoring group

The cyberattack that disrupted production at Jaguar Land Rover (JLR) for more than a month is estimated to have cost the British economy £1.9 billion ($2.5 billion), according to a monitoring group.

An analysis by the Cyber Monitoring Centre (CMC), a nonprofit that aims to examine the cost of cyber incidents, said the attack is “the most economically damaging cyber event” to ever impact the United Kingdom.

Earlier this month, JLR announced it was beginning a phased restart of its manufacturing operations following a complete global shutdown which threatened to bankrupt the businesses in its supply chain.

The impact to JLR’s supply chain caused what one senior British politician called “a cyber shockwave ripping through our industrial heartlands,” with potentially thousands of jobs put at risk.

Alongside emergency support provided by the British government, JLR said it was launching a financing scheme to provide some of its suppliers with up-front cash to help them overcome the financial difficulties caused by the shutdown.

The CMC estimated that more than 5,000 organizations in Britain were impacted by the cyberattack. It said the cost reflected both the disruption to JLR’s own production — accounting for roughly 4% of all British goods exports last year — as well as its multi-tier manufacturing supply chain and downstream organizations such as dealerships.

Ciaran Martin, the chair of the CMC’s technical committee, said the sheer size of the estimated cost should make all organisations pause and think about how to protect their networks.

“Cyber resilience, and the lack of it, is morphing from being a risk to organisational security to a risk to economic security and, by extension, national security,” he said.

Will Mayes, the CMC's chief executive, said: “We tend to think of systemic cyber risk as something that spreads through shared IT infrastructure: the cloud, a common software platform, or self-propagating malware.

“What this incident demonstrates is how a cyber attack on a single major manufacturer can cascade through thousands of businesses, disrupting suppliers, transport, and local economies, and triggering billions in losses across the UK economy.”