Cyber insurance: when the disruption comes from your customer

After the cyberattack, who pays? · Part 3/8

From supplier Autins to retailer Vertu, JLR’s shutdown exposes two kinds of dependence that insurance contracts can treat differently. The recoveries reported by Vertu and Marks & Spencer show how an insured loss becomes money, and when it arrives.

In its half-year results on 8 October 2025, Vertu Motors described the disruption that the cyberattack on Jaguar Land Rover had brought to its ten JLR dealerships. Supplies of vehicles and parts had been interrupted, along with the systems on which the dealerships relied. The retailer estimated a possible impact of up to £5.5 million on its annual adjusted profit before tax. It was also examining another route to recovering some of that loss: its insurance included cover for business interruption arising from third-party systems. 1

The following spring, Vertu could identify how much of the loss its insurers would bear. It announced a net insurance settlement of £3.4 million, then reported a cash receipt in May. The sequence included agreement on the amount, the application of an excess and an earlier announcement of an interim payment. Together, the documents make it possible to follow an actual recovery beyond the initial statement that an incident might be insured. 2 3 14

The first two instalments followed the shutdown through JLR’s factories and cash flow, then suppliers’ orders and access to credit. Insurance introduces a further question: where in that chain does the business seeking compensation sit? A component maker depends on the manufacturer’s purchases; a dealership depends on the vehicles and parts it supplies. Both relationships create substantial economic dependence, yet a policy can treat them differently. The distance between the production network and the network of insurance cover helps determine where the financial damage ultimately falls.

JLR’s place in the chain changes the insurance question

Consider JLR from the perspective of its business partners. In September 2025, Autins described the effects of its customer’s shutdown on its own operations, announcing changes to working hours, purchases of materials and spending. Vertu experienced disruption from the other end of the commercial relationship, through the goods and services that JLR supplied to its dealerships. The same manufacturer therefore occupied two different positions in the claims its partners might prepare. 4 1

Cover described as dependent business interruption might initially seem broad enough to encompass both. In an insurance contract, however, dependence helps define the boundaries of protection. Beazley’s public guide gives the example of a supplier’s shutdown preventing the insured business from producing its goods as a potentially covered event. It distinguishes that situation from an outage at a customer that removes demand: in the latter example, the relationship falls outside the definition used. 5

Following the order makes the distinction easier to understand. Upstream of the manufacturer, a business may retain its skills and productive capacity while losing its market. Downstream, a retailer may retain its customers while losing access to the goods or services needed to serve them. Revenue suffers in both cases, through different sequences of events. Those sequences matter when the policy is read against the loss.

The scope also changes between insurers and policy versions. For this type of dependence, the UK Hiscox specimen dated April 2023 refers to IT services or outsourced business functions supplied under a written contract; its definition of outsourced business functions excludes supply-chain provision. 6 Comparing the two documents shows why the relationship actually insured needs close attention. These public examples are separate from the individual policies held by Autins and Vertu, which were unavailable to this investigation.

Method and scope

The arrows represent trading relationships and their disruption. Beazley’s guidance distinguishes a supplier’s outage from a customer’s; Hiscox defines a narrower group of service providers. CFC’s named-customer extension, presented in January 2026, illustrates another approach. Autins’ individual coverage remains unknown, and these policy examples do not describe Vertu’s own contract.

Figure fonts and licences

Figure fonts: Inter Variable and JetBrains Mono Variable, under the SIL Open Font License 1.1. Inter · JetBrains Mono.

A useful insurance map therefore begins with the flows: who supplies what, who places the orders, and which systems enable the exchange? It can reveal an exposure that is less apparent on a map of IT infrastructure. A manufacturer may have identified its critical hosting provider carefully while depending for its cash receipts on a customer whose technical decisions it has little influence over. That commercial dependence then needs to be compared with the policy purchased, including the entities it names and the events that trigger cover.

For Autins, reaching a conclusion about insurance would require the policy schedule and endorsements in force when the incident occurred. The existence of a loss and the existence of a policy labelled cyber insurance establish separate facts. Evidence linking the two is essential to assessing a claim.

Writing the customer into the policy

On 8 January 2026, CFC described an extension for business interruption at customers, available as an endorsement to its SME offering. The insured business chooses the customers to be named, with an agreed aggregate limit for each. The mechanism described addresses a malicious attack that forces the customer to reduce or stop its purchases. 7

This structure brings into focus an issue that the broad term supply chain can obscure. A business wants to protect the income a commercial partner generates; the insurer wants to identify the exposure it is accepting. Naming the customer aligns those two perspectives. The associated limit then puts a contractual amount on a dependence whose economic value may be substantially larger.

CFC announced the extension after the JLR incident. Its statement describes a product and its commercial purpose, leaving open the terms on which JLR’s suppliers were insured in September 2025. Its relevance here is more specific: the loss of a customer’s business following an attack can be addressed through an explicit extension. That extension would still need to be purchased, apply to the entity affected and provide sufficient cover for the exposure the business intended to transfer.

The practical assessment begins with the customer relationship. If one customer accounts for a large share of an engineering firm’s orders, how much income would disappear during a shutdown, and which costs would continue? When would available cash become insufficient? Reconstructing that situation provides a basis for comparing an insurance limit with the business’s needs. It also clarifies the role of commercial diversification: spreading orders among customers changes the underlying dependence, while insurance allocates part of the financial consequences when disruption occurs.

The period used to measure a loss

Once the covered relationship has been identified, the loss still has to fit the policy’s timetable. Under the income-loss option in the Hiscox specimen examined here, losses during the time excess, a deductible measured in time, are excluded. Cover ends at the earliest of three conditions: continuous interruption and material impairment of the relevant parts of the system cease, the indemnity period ends, or the applicable limit is exhausted. 6

The next illustration sets out that logic on a symbolic timeline, separating the period during which the business experiences disruption from the period used to calculate covered losses. The durations specified in the individual policies remain unknown for the companies discussed here. Adding a twenty-four- or seventy-two-hour time excess would introduce a contractual detail that the available documents do not establish.

Method and scope

The income-loss option in Hiscox specimen WD-PIP-UK-CCLEAR(5), reference 19029 04/23, page 15. Durations, the monetary excess and limits depend on a schedule absent from the document. This symbolic timeline describes the eligibility window; the recoverable amount also depends on substantiated losses and the remaining policy terms.

The distinction matters beyond the wording of a clause. Restoring an IT system and restoring commercial performance describe different events. An engineering firm might, for example, regain access to a tool before rebuilding its order book. A postponed sale might still go ahead, whereas an order placed with a competitor would follow another course. Assessing the financial damage requires those situations to be distinguished before examining how the contract treats each one.

Missing revenue is therefore a starting point for the investigation, with further work needed to establish the amount that can be claimed. The calculation has to reconstruct earnings over the relevant period, taking account of costs and actual trading. Beazley’s guide defines lost income by reference to earnings before interest and tax together with normal expenses that must continue. 5 This helps explain why sales, profit and a need for cash measure different aspects of an interruption.

Consider an order that is delivered late, without assigning it a hypothetical value. The delay can create an immediate cash shortfall and additional costs even though some of the revenue will eventually arrive. When an order is cancelled altogether, the commercial loss may persist, while some associated purchases may have been avoided. Distinguishing the two produces a closer account of the business’s experience and helps prevent the same shortfall from being counted under several headings.

The documentary work needs to preserve those distinctions. Order histories, correspondence about cancellations, invoices for temporary arrangements and dates of service restoration could connect the technical incident to its consequences. Public accounts offer a more aggregated view. They are valuable for tracking what a company reports and recognises, while usually leaving the evidence used to negotiate individual elements of a settlement outside the public record.

Vertu’s settlement crosses a financial year-end

Vertu’s disclosures offer an unusual opportunity to move from these principles to a verifiable sequence of events. On 5 March 2026, the retailer reported that its JLR operations had returned to normal. It announced that an interim insurance payment of £1 million had been agreed and was expected in the following days. This establishes the agreement and the expectation of payment; the announcement gives no date for the actual transfer. 14

On 30 April, the settlement was set at £3.9 million before a £500,000 excess, leaving £3.4 million net. The interim payment announced in March was included in that total, making the additional amount £2.4 million. 2 The excess provides a directly documented measure of the amount retained by Vertu within the settlement described. Assessing its entire retained exposure would require the full scope of the loss and claim.

Method and scope

The £3.4m net settlement includes the £1m advance announced as agreed on 5 March. Results published on 13 May place receipt of the settlement in May. The disclosures leave the detailed transfer schedule unresolved. Bar widths scale with amounts; milestones show their sequence without a duration scale.

The results published on 13 May set the net insurance income against JLR losses assessed at £3.9 million. They recognise the income in the year ended 28 February 2026, while placing receipt after that year-end and referring to cash received in May. 3 The annual report preserves this separation. 15 The same claim thus appears in one year’s earnings and the following year’s cash flow.

The earlier announcement of an interim payment expected in March requires care when interpreting that sequence. The documents examined establish the first agreement, the final settlement and a reported receipt, while leaving the detailed schedule of transfers undisclosed. They provide insufficient detail to say that the whole £3.4 million arrived in a single transfer in May. Equally, the interval between the attack and the final agreement, taken on its own, would be an inadequate measure of the time needed to process a complete claim.

This chronology illuminates the financing of an interruption. Accounts can recognise a right to an insurance recovery before the money becomes available for the business to use. Assessing its financing needs therefore requires the dates on which wages, suppliers and debt must be paid to be set against the cash actually available. The amount ultimately agreed establishes the loss transferred to the insurer; the payment schedule determines how that recovery contributes to financial continuity.

Vertu also provides a useful qualification to a narrative of cascading disaster: insurance held by one of the manufacturer’s commercial partners produced a settlement. The retailer had identified potentially responsive cover and went on to publish the outcome. This investigation remains within those disclosures, without attributing to Vertu either of the specimen policies used earlier to explain the mechanisms.

Marks & Spencer: cash received, wider damage still to assess

Marks & Spencer offers a second vantage point, this time from a company directly affected by an attack. In its first-half 2025/26 results, published on 5 November 2025, the group recognised £100 million of insurance income and £101.6 million of direct incident costs. 9 Its annual results subsequently confirmed that the insurance money had been received during that first half, which ended on 27 September 2025. 10

Receipt is therefore established within a six-month reporting window. That is precise enough to support a material finding: a substantial payment arrived during the financial year in which the crisis occurred. Any account of cyber insurance that assumed claims invariably remained unpaid throughout recovery would miss this case. The analysis needs to follow observed payments at the level of precision the documents provide.

By the annual reporting date of 28 March 2026, direct incident costs had reached £131.3 million. The annual report retained the £100 million of insurance income within adjusted profit, while presenting the direct costs separately as adjusting items. 11 Readers comparing those amounts need to keep the presentation in view: they describe different categories, and adjusted profit follows a reporting convention that the company explains.

Method and scope

Direct expenses are adjusting items, while insurance income is included in adjusted profit. The first-half £100m is included in the annual figure. Its allocation by cover section remains unknown; setting the receipt against direct costs alone leaves trading effects outside a calculation of the complete net economic loss.

The question of the total cost extends further. Spending on response and restoration accompanies the commercial effects of an interruption, including missed sales, disrupted stocks and efforts to rebuild trading. Reducing the analysis to £131.3 million of direct expenses alongside £100 million of insurance would treat those expenses as an exhaustive measure of the incident. The publications examined provide no breakdown of the settlement that would justify allocating the entire payment to that category.

Another figure needs similar care. In May 2025, M&S had estimated an impact of around £300 million on operating profit for the 2025/26 financial year then under way, before cost mitigation, insurance and trading actions. 8 This was a forecast made at a particular point in the recovery. Automatically subtracting the eventual insurance payment would turn an initial estimate into a final account, bypassing the work needed to reconstruct the damage actually sustained.

The most useful information comes from reading the documents together: insurance was received, direct costs continued to be recognised, and the isolation of the commercial damage requires further evidence. Keeping those scopes distinct makes the figures more meaningful to both the business and its readers. The contribution from insurance can be established while the full consequences remain open to assessment.

JLR’s own cover remains an open question

At the centre of the chain, JLR’s position calls for a different kind of care. On 23 September 2025, The Insurer reported, citing unnamed market sources, that a cyber placement had apparently not been completed before the incident and that JLR appeared to lack direct cover. The publication said JLR, Lockton and Tata had declined to comment, and that it had been unable to verify whether Tata held any separate cover. 12

The claim has since been repeated in Parliament. On 14 July 2026, Baroness Paul of Shepherd’s Bush described JLR as having no cyber insurance. That public statement leaves the group’s policies and the scope of any Tata cover undisclosed. 18

The press report and parliamentary statement warrant reporting with their attributions and qualifications intact. The primary documents examined for this instalment establish neither the insurance programme applicable to the incident nor a final amount recovered by JLR. Its annual report mentions other insurance arrangements and an insurance subsidiary, whose existence alone says little about cover for this particular event. 13 In a chart, this gap should remain an unknown value; replacing it with zero would create an unsupported conclusion.

This care also improves the comparison. Vertu publishes a settlement, M&S describes insurance money received, and JLR’s cyber programme remains insufficiently documented in the material reviewed. Ranking them as well or poorly insured would require comparable information about their decisions, policies and losses. The available evidence illuminates particular mechanisms and outcomes, with uneven visibility into the choices that preceded them.

Insuring a dependence creates a concentration to manage

For an insurer, tracing commercial relationships raises a further question: how many policies might one event trigger? If several insured businesses depend on the same manufacturer, their exposures share a common source. An apparently diverse set of policyholders can therefore contain a concentration of risk. That follows from the structure of the network, without requiring an invented aggregate loss estimate.

The UK’s Prudential Regulation Authority expects insurers to assess and manage their cyber exposures, including those arising where contracts are silent about whether cyber risk is included or excluded. Its supervisory statement, in the November 2024 version, also calls for testing that takes account of aggregated losses. 17 This framework helps explain why identifying dependencies and setting limits matter on both sides of an insurance contract.

For a business, the starting point is its own operations: an indispensable system, a supplier that would be difficult to replace, or a customer whose shutdown would remove orders. For the insurer, that map has to be assessed alongside all the other exposures it has accepted. An extension can broaden a supplier’s protection while requiring a more detailed assessment of concentration around its customer. Product development thus brings commercial relationships into the evaluation of cyber risk.

The next documentary step would be to obtain the policies actually purchased, their effective dates and the settlement decisions. For Vertu, those records would identify the section of cover used and the sequence of payments. For a supplier such as Autins, they would clarify how the cessation of orders was treated. For JLR, the prior question remains the scope of the policies and the entities insured. This investigation draws on public documents; no interviews or company responses have been obtained.

Vertu already offers a concrete answer to this series’ central question: part of the loss was transferred to insurers, subject to a documented excess and payment chronology. The comparison with suppliers and M&S identifies the evidence needed to go further: the relationship protected, the damage accepted and the arrival of the money. It is where the map of insurance meets the payments a business must make to keep operating.

Method and scope

This documentary investigation was completed with a cut-off date of 18 October 2026. It combines company financial publications, regulatory announcements, public specimen policies and explanations from insurers, and a statement from the UK prudential supervisor. Vertu’s publication of 14 October 2026 was also examined to bring the collection up to date. 16 The press report on JLR’s cover and the parliamentary statement remain attributed to their authors. Individual policies, complete claim files and bank-transfer records remain outside the material available. The illustrations distinguish reported amounts, reproducible calculations and explanatory mechanisms; reporting periods are kept separate from publication and receipt dates.

Further reading

The first instalment on JLR’s factories and the second on supplier funding trace the shutdown’s propagation. The operating working capital guide explains spending committed before cash arrives. Our investigation of Greensill, insurance and future receivables examines a different protection contract, credit insurance, whose scope also shapes access to funding.

Documentary sources

Numbered references link to the documents below. Accessed: 18 October 2026.

1. [1] Vertu Motors plc : RNS / FCA · Unaudited interim results for the six months ended 31 August 2025 · 2025-10-08. Current trading / Outlook; CEO review, JLR disruption and third-party systems outage policy. Vertu discloses third-party outage cover and forecasts up to £5.5m of FY26 profit impact. A dated forecast; interim accounts end before September. Full terms and settlement were then undisclosed.
2. [2] Vertu Motors plc : RNS · Business Interruption Insurance Settlement · 2026-04-30. RNS 4797C, settlement amount and FY26 recognition paragraphs. Settlement announced: £3.9m less a £0.5m deductible gives £3.4m net recovery, including the £1m interim amount. The agreement and recognition are documented; this release does not itemise every cash transfer. The same announcement republished by Stockopedia.
3. [3] Vertu Motors plc · Final results for the year ended 28 February 2026 · 2026-05-13. PDF p.1; p.13, cash received in May; p.20, FY26 recognition and cash after year-end. £3.4m recognised in FY26; cash receipt is placed in May, after year-end, against an estimated £3.9m disruption impact. Rounded amounts and company attribution. Individual instalment dates remain unavailable.
4. [4] Autins Group plc · AGM Trading Update · 2025-09-17. RNS 5904Z; paragraphs naming JLR and the spending measures. Autins names JLR and reports banked hours, delayed or cancelled raw-material purchases and paused discretionary spending. Company statement; this announcement does not describe insurance for those losses.
5. [5] Beazley · Policy Wording and Guidance : Cyber business interruption · undated. Dependent Business Interruption Loss; Income Loss; Extra Expense, definitions and examples. The guide contrasts supplier and customer dependencies and explains earnings, continuing expenses and extra costs. Illustrative commercial guidance; terms vary by policy and jurisdiction.
6. [6] Hiscox UK · Cyber and data insurance : Policy wording · 04/23. PDF pp.3–6, definitions; pp.7–8, coverage; pp.14–15, excess, limits and end of indemnification. This specimen defines dependent businesses, business interruption losses, time excesses and contractual limits on indemnification. UK 04/23 specimen; the schedule is absent. No attribution to JLR, Vertu or M&S policies.
7. [7] CFC · Cyber coverage highlights: Customer business interruption · 2026-01-08. How the coverage works; Customer business interruption cover in action. CFC presents cover for reduced purchases by named customers following malicious cyber events, with an agreed limit for each customer. Commercial announcement; full endorsement unavailable. The automotive example is anonymous and postdates the JLR incident.
8. [8] Marks and Spencer Group plc · Full Year Results for the 52 Weeks Ended 29 March 2025 · 2025-05-21. PDF pp.1 and 3; p.52, post-balance-sheet event. M&S forecasts around £300m of FY2025/26 operating profit impact before cost mitigation, insurance and trading actions. May 2025 forecast, distinct from the March year-end accounts and any final loss estimate.
9. [9] Marks and Spencer Group plc · Half Year Results for the 26 Weeks Ended 27 September 2025 · 2025-11-05. PDF pp.2–3; note 2, pp.35–36; note 3, pp.37–38. M&S recognises £100m insurance income within adjusted profit and presents £101.6m direct costs separately as adjusting items. Different scopes; subtraction does not establish the attack’s net economic cost.
10. [10] Marks and Spencer Group plc · Full Year Results for the 52 Weeks Ended 28 March 2026 · 2026-05-20. PDF p.2; p.19, insurance received in the first half; notes 2 and 3, pp.34 and 37. The full year retains £100m insurance income, received in the first half, and reports £131.3m direct costs. Annual £100m includes the half-year amount; transfer dates and settlement allocation are undisclosed.
11. [11] Marks and Spencer Group plc; independent auditor Deloitte LLP · Annual Report and Financial Statements 2026 · 2026-06-01. Printed pp.20, 128 and 132 (PDF 22, 130 and 134); auditor’s report pp.101–102. The audited report confirms insurance and £131.3m direct costs, including £109.3m immediate response and restoration costs. The financial audit is not a public settlement breakdown for every insured loss. Official reports calendar.
12. [12] The Insurer / Reuters · Exclusive: Jaguar Land Rover failed to secure cyber insurance deal ahead of incident, sources say · 2025-09-23. Opening paragraphs: unnamed sources, reported direct coverage gap and uncertainty about a Tata policy. The report describes an apparent gap in JLR’s direct cyber cover; any Tata policy remained unconfirmed. Unnamed sources; JLR, Tata and Lockton declined comment. No policy or insurance settlement is published.
13. [13] Jaguar Land Rover Automotive plc · Annual Report FY25/26 · FY25/26. Note 4, printed p.177 (PDF p.89); insurance pp.109 and 202; subsidiaries p.229; approval p.151 (PDF p.76). JLR classifies £260m cyber expenses as exceptional and mentions other insurance without publishing an applicable cyber policy. Recognised expenses; indemnification details remain unavailable, without establishing the absence of every possible coverage. Authorised for issue on 21 May 2026; first publication date unestablished. The 16 July date in the web path identifies the hosted version.
14. [14] Vertu Motors plc · Trading Update · 2026-03-05. PDF p.4, JLR: agreed interim payment and expected receipt. Vertu announces an agreed £1m interim payment, expected in the following days and to be recognised in FY26. Agreement and expectation are disclosed; the instalment’s actual bank receipt date is not established.
15. [15] Vertu Motors plc · Annual Report and Accounts 2026 · 2026-05-22. PDF pp.3, 20 and 29; note 6, p.118 (printed p.117). The report confirms insurance treatment; note 6 gives £3.391m, rounded to £3.4m in the narrative. Detailed amount consistent with the announced rounded figure; report availability notice dated 22 May. Official publication notice.
16. [16] Vertu Motors plc · Unaudited interim results for the six months ended 31 August 2026 · 2026-10-14. PDF p.1, dates and results; p.30, principal risks. Latest interim publication checked before the research cutoff; the new results cover six months ended 31 August 2026. Currentness check; the document does not establish a new cyber settlement payment schedule.
17. [17] Prudential Regulation Authority / Bank of England · SS4/17 : Cyber insurance underwriting risk · 2024-11-15. PDF p.6, §1.6; p.7, §2.1 and §3.2; p.8, §3.3. The PRA distinguishes affirmative and non-affirmative cyber risks and expects exposure limits, underwriting strategies and accumulation testing. Prudential expectations for insurers; no ruling on any individual indemnity.
18. [18] UK Parliament, Hansard · Cyber Security and Resilience (Network and Information Systems) Bill · 2026-07-14. Baroness Paul of Shepherd’s Bush, 6.31 pm. Primary evidence for her statement; this passage discloses no JLR policy or scope of Tata cover.

Original text and illustrations: l0g · CC BY 4.0. Cited documents retain their publishers’ rights.