JLR: a cyberattack’s footprint in GDP

After the cyberattack, who pays? · Part 4/8

The £1.9 billion estimate of the JLR disruption rested on a recovery path that was still uncertain. Revised statistics and company disclosures now allow that scenario to be tested, the missing production to be traced and the work behind the rebound to come into view.

On 13 November 2025, the cyberattack on Jaguar Land Rover appeared in Britain’s gross domestic product figures. The Office for National Statistics estimated that manufacturing of motor vehicles, trailers and semi-trailers had fallen by 28.6% in September compared with August. The industry subtracted 0.17 percentage points from the monthly change in GDP, while the economy as a whole contracted by an estimated 0.1%. Activity elsewhere had therefore offset some of the industrial decline in the national result. 1

A few weeks earlier, on 22 October, the Cyber Monitoring Centre had put a different measure on the disruption: an estimated £1.9 billion financial impact on the UK operations of affected organisations. Its assessment extended through the businesses that depended on the carmaker, from suppliers to dealerships and local companies. It used information available up to 17 October, while production was still restarting. 3

Together, these publications bring another dimension to the question running through this series. Having followed JLR’s factories, suppliers’ borrowing and insurance settlements, we need to examine what the disruption takes away from an economy. A lost order, a wage paid during a stoppage, a car delivered later and a repair bill each follow a different path. Understanding the £1.9 billion estimate means tracing those paths, then testing October’s scenario against the months that followed.

Several industrial stories behind the missing cars

The first measure is tangible. For September 2025, the Society of Motor Manufacturers and Traders counted 51,090 cars leaving British factories, compared with 70,039 a year earlier. The difference was 18,949 cars, a decline of 27.1%. The industry body attributed most of the fall to the shutdown caused by the cyberattack, while reporting growth at the other volume manufacturers. 2

That comparison gives the disruption a scale readers can picture, although September 2024 remains a historical benchmark. Establishing how many cars were actually lost because of the attack would require an estimate of what the same factories would have produced in September 2025 under that year’s trading conditions. Orders, available models and manufacturing capacity could all have changed between the two dates.

The SMMT release itself shows why attribution requires care. Its headline reported a 35.9% decline in total vehicle production. That total also included commercial vehicles, whose output fell from 14,643 to 3,229 units amid the consolidation of manufacturing at another major producer. Treating the entire fall in cars and commercial vehicles as a cyber loss would combine two separately documented mechanisms. 2

The ONS index has a different scope again. It covers the automotive industry as defined in the statistical classification, including trailers and some component manufacturers. Turnover data are adjusted for price changes to approximate the volume of activity; the series used here is also seasonally adjusted. The SMMT counts vehicles. Differences between a high-value car, a small car and an industrial component therefore matter more to the ONS measure than to a simple count of units. The statistical office explains these methodological differences in a dedicated comparison. 16

To follow the recovery using a consistent set of figures, we took a single version of the ONS series, published on 15 October 2026. Setting August 2025 to 100 puts September at 69.9, October at 77.5, November at 97.3 and December at 94.1. All five underlying index values come from that release; the raw values and formula appear beneath the chart and in source note 4. 4

Method and scope

ONS K23U covers the entire UK motor vehicles, trailers and semi-trailers industry. Every point comes from the 15 October 2026 version and is rebased to August 2025. The hatched area represents the gap from that descriptive benchmark, not a causal loss. The segments connect monthly observations; they do not describe daily output. ONS K23U values for August to December 2025, in order: 88.5; 61.9; 68.6; 86.1; 83.3 (series reference: 2024 = 100). Rebasing: monthly index ÷ 88.5 × 100. Change between months: (final index ÷ initial index − 1) × 100. Calculations are rounded to one decimal from published inputs that are themselves rounded.

Figure fonts and licences

Figure fonts: Inter Variable and JetBrains Mono Variable, under the SIL Open Font License 1.1. Inter · JetBrains Mono.

The trough and subsequent recovery are clear. Between October and November, the index rose by about 25.5%, while remaining 2.7% below its August level. This combination helps explain how a rebound works: it measures the pace of recovery from a low starting point. Restoring a production rate and making up the volume missed during a stoppage involve two separate efforts.

Revisions also matter. The October 2026 release implies a fall of about 30.1% between August and September 2025, whereas the initial bulletin reported 28.6%. The ONS says the newer release incorporates revisions associated with Blue Book 2026, among other changes. The contribution of 0.17 percentage points quoted at the start of this article belongs to the estimate published on 13 November 2025. Keeping that publication date attached preserves what the figure told readers at the time. 1 4 5

The £1.9 billion estimate had a timetable

The Cyber Monitoring Centre’s model addressed a more ambitious question than the number of cars built: what would the eventual financial loss be across affected UK operations, once dependence on the carmaker was taken into account? The centre published an estimate of £1.9 billion within a modelled range of £1.6 billion to £2.1 billion. The assessment included lost profits, fixed costs and the restoration of systems, then extended to suppliers and businesses further along the commercial chain. Its geographical boundary was the UK. 3

There is an immediate use for this approach. During a crisis, waiting for every company’s annual accounts would leave decision-makers without an assessment of its scale for a long time. A model can connect fragments of evidence, provided its assumptions remain visible and its result retains the status of an estimate. That is what makes the October document useful to revisit after production has resumed.

Its manufacturing scenario assumed a linear recovery from 8 October to full production in early January 2026. It also incorporated three months at 120% of pre-incident capacity, drawing in part on banked working hours, without giving precise dates for that period of additional production. Both the date of recovery and the shape of the climb towards it therefore influenced the expected loss. 3

Later information from JLR changes how we assess that assumption. In results published on 5 February 2026, the group said vehicle production had returned to normal levels by mid-November. It then described the time required to distribute the newly produced vehicles around the world. The production milestone reported by the company came appreciably earlier than the beginning of January assumed in the scenario. Deliveries and commercial results followed their own timetable. 7

Method and scope

CMC’s scenario is assessed as of 17 October and published on 22 October 2025. It assumes a straight-line recovery from 8 October to early January 2026. The same document includes three months at 120% of pre-event capacity without fixing exact calendar dates; that duration is shown separately. On 5 February 2026, JLR reports that normal production had resumed by mid-November. Differences in scope and the available evidence prevent a mechanical recalculation of cost from that timing difference alone.

That difference warrants a reassessment using the realised data. It provides too little information, however, to announce a new total in pounds. Replacing January with November in a rough calculation would leave the daily recovery profile, losses already incurred, suppliers’ circumstances and subsequently recovered sales unresolved. JLR’s statement about normal production and the index for an entire British industry also cover different sets of operations.

Both findings deserve to stand. The production milestone reported by JLR predates the one assumed in the original scenario. CMC models affected UK operations, whereas JLR describes group production. The gap between those dates, by itself, leaves the final value of the wider loss open. A revised amount would require the detailed model, its parameters and recovery data comparable with what it sought to forecast.

The CMC’s classification serves a particular purpose. Its method combines the scale of financial impact and the number of affected organisations on a scale from 1 to 5. To be included in that population, an organisation must sustain a financial impact of at least £1,000 on its UK operations. Category 3 therefore describes economic severity within this framework; it is a different measure from the technical sophistication of the intrusion. 8

The centre also says later information will inform its learning without changing the classification assigned to this event. 3 That choice can preserve consistency in an indicator produced during unfolding crises. For readers seeking the cost actually incurred a year later, it makes the date and status of the original figure all the more consequential.

A car passes through several companies’ accounts

Consider a component made by a supplier and then fitted into a car. Its sale creates revenue for the supplier and a purchase for the manufacturer. When the car is sold, part of the component’s value is already included in the vehicle’s value. Adding up every successive company’s turnover would count some of what moves through the chain more than once.

National accounts address this by measuring value added. Each activity contributes the value of its output less the goods and services consumed in producing it. Assembly adds value to the components received; the value created by their manufacturer has already been counted at the preceding stage. Adding up the value added produced within the territory, then adding taxes on products and subtracting subsidies on products, gives GDP. 9

Distribution requires a further distinction. In wholesale and retail trade, the output of the trading service is measured by the margin on goods resold. The service’s other intermediate consumption must still be taken into account to arrive at its value added. Counting the full price of the car again as the dealership’s output would artificially inflate the activity being measured. 17

Method and scope

A simplified production chain, without amounts or proportional areas. A component bought by the assembler is already embodied in its output; following value added distinguishes each stage’s contribution. The distributor’s output is its trading margin, while its value added also deducts the intermediate consumption used to provide the service. The GDP formula applies to gross value added across the whole UK economy, plus taxes on products less subsidies.

This explains why the CMC’s £1.9 billion and the automotive industry’s contribution to GDP need to be read differently. The first estimates a set of financial losses associated with an event. The second forms part of a measure of national production over a specified period. Their scopes can overlap while omitting different things: a customer’s waiting time, spending to rebuild systems and a sale redirected to a competitor each require a particular treatment.

The national boundary matters just as much. A car made in the UK and then exported contributes to British activity; imported components incorporated into that car were produced elsewhere. The country in which a group has its headquarters or principal shareholder, meanwhile, tells us little about the location of all its production. Connecting a company’s loss to British GDP means tracing the operations performed in the UK and their intermediate purchases. 9

Even official statistics take time to refine this picture. The ONS explains that intermediate consumption data are collected annually and that, for most industries, the initial monthly estimates use output volumes or turnover adjusted for prices as a proxy for value added. Full balancing follows in the annual accounts. 15 The monthly index is therefore a valuable signal of industrial activity, subject to the conventions and revisions involved in its construction.

Britain’s department responsible for digital policy makes a similar methodological point about its own cyber cost studies. Presenting them in November 2025, it explained that the research used different methods and scopes, so the estimates should not be added together to produce a single GDP impact. 10 That warning concerns this particular collection of studies. Its relevance here lies in the method: a sum of carefully sourced figures can still mislead when the things being measured overlap.

The work required to fill the trough

The area below August’s level in our chart gives a visual sense of the production missing relative to that benchmark. It helps distinguish a rate from a cumulative amount. Converting it into a cyber loss would require showing that August provided an appropriate reference path for every subsequent month, then isolating the attack’s effects within an entire industry.

Other influences are documented. In its review of 2025, the SMMT describes an industry affected by tariffs, preparations for new models, restructuring and the cyberincident. JLR also identifies the planned end of production of older Jaguar models, a weakening Chinese market and US tariffs among the factors affecting its volumes or profitability. 6 7 A comparison with the previous year brings those changes together with the consequences of the outage itself.

A rebound can also create a stronger impression of catch-up than the underlying measure supports. In May 2026, the ONS explained that the automotive industry’s 10.9% growth in the three months to March, compared with the preceding three months, reflected a base effect: the comparison period still included October 2025, when disruption continued to affect activity. 15 Moving beyond a depressed quarter mechanically improves the growth rate. Establishing whether cars whose manufacture was delayed were eventually made would require following cumulative volumes and orders through to delivery.

At Autins, the organisation of working time gives that effort a human dimension. Well before the attack, in its 2023 annual report, the components supplier described a banked-hours scheme designed to keep monthly income stable while working hours adjusted to demand. Staff could work less when production slowed and more when they were needed. 12

On 17 September 2025, Autins announced that it was using the scheme during the JLR stoppage, alongside changes to raw-material orders and spending. 13 In results published on 29 June 2026, management said this combination had limited the financial impact and preserved operational readiness for the resumption of production. 14 The documents trace an existing arrangement, its use during the crisis and the company’s subsequent assessment of its role.

Method and scope

The diagram shows the banked-hours arrangement described in Autins’ 2023 report and activated during JLR’s shutdown according to its 17 September 2025 statement. Results published on 29 June 2026 cite the arrangement among measures management says limited the impact and maintained operational readiness. Cells and intervals are symbolic. No number of hours, salary amount, individual balance or recovery schedule is inferred from these documents.

The principle moves part of the adjustment into the working calendar. It can help maintain income and keep a team available while reserving hours for periods when orders return. Recovery then depends on people, skills and the organisation of shifts as well as the restoration of systems.

The consequences for individual workers still need documenting. The publications establish the arrangement and its use, without detailing time balances, applicable limits, premiums or each employee’s payments in 2025. They support a diagram of the mechanism using a symbolic timeline. The precise distribution of disruption between the company, permanent employees and agency workers remains open.

That distinction matters when interpreting a national cost. Maintaining wages during a fall in activity can protect household income while leaving the company to absorb more of the shock. Reduced pay transfers some of the pressure to the worker. Moving from these situations to an assessment of the wider cost requires tracing both the resources lost and who bears the burden, taking care to avoid counting the same consequence repeatedly as it appears in different accounts.

Compensation shifts the burden; repair uses resources

The previous article followed the path from disruption to an insurance settlement. Across the economy, insurance reveals another boundary. The Home Office’s methodological framework distinguishes domestic financial transfers, including insurance payouts, from the resources actually used to administer insurance. The former redistribute a burden; the latter occupy people and resources that could have served another purpose. 11

The same reasoning helps us examine repair costs. A service that restores systems is a bill for its purchaser and business activity for its provider. It uses time, skills and sometimes equipment. It can be essential to restarting operations while also drawing resources away from other possible uses. Calculating its effect on GDP would require tracing its economic treatment, intermediate purchases and the activities it displaces.

The investigation therefore needs to ask who pays alongside what resources are consumed. An insurance agreement tells us about the financial distribution of the burden. Factory days, orders eventually cancelled and restoration work tell us what had to be absorbed or rebuilt. These perspectives complement each other when transfers, production and opportunity costs retain their distinct meanings.

The next evidence to obtain is an explicit reconciliation of the CMC scenario with realised outcomes: production profiles by site, orders recovered or lost, suppliers’ retained capacity and the cost of additional resources employed. Public information already allows us to test one timing assumption. A verifiable reassessment would show how each new observation changes the calculation, and with what uncertainty.

JLR’s restart restored its ability to manufacture. The attack’s ultimate cost also depends on what happened to delayed orders and the resources used to fulfil them. That is where an economic investigation returns to employees and suppliers: in the work required to turn a restart into delivered cars, and in the resources absorbed while they waited.

Method and limits

This documentary investigation uses material checked as of 18 October 2026. ONS figures retain their publication dates: the initial bulletin reconstructs the information available in November 2025, while the chart exclusively uses the K23U series published on 15 October 2026. Raw values and formulas for rebasing the index and measuring changes appear beneath the first chart and in source note 4. August = 100 remains a descriptive benchmark.

The CMC amount is a scenario estimate with a specified information cut-off and UK scope. We retain its published range without assigning a statistical probability that the document does not provide. JLR’s recovery milestone and Autins’ assessment are attributed to the companies that published them. The detailed CMC model, internal orders and individual working-time accounts remain outside the documentary record. No interviews were conducted. Source notes provide original references, locators and the limits of each item of evidence; the two mechanism diagrams use symbolic quantities.

Further reading

The instalment on supplier funding traces the cash needed to wait and restart. The investigation of cyber insurance cover examines the passage from a loss to compensation. The glossary explains GDP, value added and base effects.

Sources

Numbered references link to the documents below. Accessed: 18 October 2026.

1. [1] Office for National Statistics · GDP monthly estimate, UK: September 2025 · 2025-11-13. Main points; The production sector / Manufacturing output, C29 change and contribution to monthly GDP. First estimate: motor manufacturing fell 28.6% in September; the industry contributed −0.17 percentage points to monthly GDP growth. Historical vintage, subsequently revised. The contribution covers the whole industry and does not isolate the causal effect of JLR.
2. [2] Society of Motor Manufacturers and Traders (SMMT) · Cyber attack hits vehicle output with new risk arising from tax charge on auto workers · 2025-10-24. Car and commercial-vehicle discussion; September 2025 UK manufacturing tables. SMMT counts 51,090 cars and 3,229 commercial vehicles produced in September 2025, with distinct explanations for their declines. Physical counts compared with September 2024. Trade-association attribution; the total fall does not measure the cyber incident alone.
3. [3] Cyber Monitoring Centre · Cyber Monitoring Centre Statement on the Jaguar Land Rover Cyber Incident – October 2025 · 2025-10-22. Financial Loss Analysis, components 1–6; CMC PDF hosted by NAA, pp.1–4; Press archive for publication date. Estimated ultimate impact on UK operations: £1.9bn, modelled range £1.6–2.1bn, using information available on 17 October. A scenario with non-public detailed parameters. The CMC PDF hosted by NAA contains a conditional £50–150 million restoration paragraph absent from current HTML. The date and reason for this difference remain unknown; it does not establish a revision to the total. PDF version hosted by NAA.
4. [4] Office for National Statistics · IOP: C29: Manufacture of motor vehicles, trailers and semi-trailers: CVMSA · 2026-10-15. K23U series, DIOP dataset; official HTML table, August to December 2025 observations, released 15 October 2026. Seasonally adjusted volume index. The chart rebases five observations to August 2025 = 100. ONS K23U values for August to December 2025, in order: 88.5; 61.9; 68.6; 86.1; 83.3 (series reference: 2024 = 100). Rebasing: monthly index ÷ 88.5 × 100. Change between months: (final index ÷ initial index − 1) × 100. Calculations are rounded to one decimal from published inputs that are themselves rounded. The whole C29 industry. August is a descriptive benchmark, not a no-attack scenario. Input data are rounded.
5. [5] Office for National Statistics · Index of Production, UK: August 2026 · 2026-10-15. Revisions to IoP; Measuring the data, consistency with Blue Book 2026. The release incorporates revisions from January 1997 to June 2026, consistent with Blue Book 2026. Documents the statistical vintage; revisions establish no change in the causal cost of the cyberattack.
6. [6] Society of Motor Manufacturers and Traders (SMMT) · Tough year for auto but new models and industrial strategy can deliver growth · 2026-01-29. Annual production discussion; car, commercial-vehicle and total 2025 tables. Annual output: 717,371 cars and 47,344 commercial vehicles; the commentary identifies several industrial and trade constraints. Annual total from the January vintage; do not sum older monthly releases or attribute every shortfall to the cyber incident.
7. [7] Jaguar Land Rover Automotive plc · JLR Q3 performance impacted by previously indicated challenges · 2026-02-05. First summary bullet and paragraphs after the results introduction; CEO statement on recovery. JLR places the return to normal production levels in mid-November 2025, followed by time needed for global distribution. Company statement. No daily UK production series or full reconciliation of recovered orders is supplied. JLR Annual Report 2026, confirming the mid-November milestone.
8. [8] Cyber Monitoring Centre · Event Categorisation Methodology : February 2025 · 2025-02. PDF p.5, Definitions; pp.6–7, data and models; p.8, finality of public categorisation. The framework defines affected population and financial impact, then fixes the category using information available at assessment. General methodology. The JLR model details and application of the per-organisation cap are not disclosed in the statement. The method caps impact per organisation at £1 billion for classification; the JLR statement does not explain its application.
9. [9] Office for National Statistics · A guide to the UK National Accounts: March 2020 · 2020-03-06. Section 3, The production approach; section 5, Production account and Financial account; section 6, Supply and use tables and input-output. Definitions of output, intermediate consumption, value added, inventories and financial transactions underpin the teaching example. Conceptual guide. The illustration uses symbolic variables; it represents neither JLR accounts nor the CMC model.
10. [10] Department for Science, Innovation and Technology (DSIT) · Summary of research on the economic impact of cyber attacks · 2025-11-12. Headline findings from independent research reports, second paragraph. The five studies have different methods and scopes; their estimates must not be added together to produce a single GDP impact. This warning concerns the DSIT collection; it is not a published criticism of the CMC methodology.
11. [11] Home Office Science Advisory Council · Understanding the costs of cyber crime : Research Report 96 · 2018-01-18. PDF page 23, printed page 23: opportunity cost, transfers and insurance. The framework distinguishes resources consumed from transfers: insurance payouts are excluded from societal cost, while resources used to administer insurance are included. A general UK economic framework published in 2018, not an estimate of the JLR incident; retain its national boundary.
12. [12] Autins Group plc (document mirrored by AnnualReports) · Autins Group plc : Annual Report and Accounts 2023 · year ended 30 September 2023; first publication date unestablished. PDF page 12, printed page 12, Social; supplementary discussion on page 15, Financial review. The report describes stable monthly income and working hours adjusted to production needs through a banked-hours scheme. Historical description; it does not establish individual 2025 payments, time balances, premiums or detailed arrangements for working the hours later.
13. [13] Autins Group plc / FCA National Storage Mechanism · Autins Group plc : AGM Trading Update (RNS 5904Z) · 2025-09-17. Paragraph on measures taken after the JLR stoppage, before the chief executive’s quotation. Autins confirms using its banked-hours scheme during the JLR stoppage, alongside adjustments to purchasing and spending. The announcement quantifies neither the hours shifted nor the number of people affected.
14. [14] Autins Group plc (RNS text mirrored by Investegate) · Autins Group plc : Final Results · 2026-06-29. CHAIR’S STATEMENT / People; CHIEF EXECUTIVE OFFICER’S REVIEW / Building a More Resilient Business. Management says banked hours and control of purchasing and spending limited the disruption and preserved readiness to resume production. Management’s assessment of a package of measures; no quantified causal attribution to banked hours alone or individual employee outcomes.
15. [15] Office for National Statistics · GDP monthly estimate, UK: March 2026 · 2026-05-14. Section 4, Manufacturing output: first-quarter C29 growth; section 11, Data sources and quality. ONS explains 10.9% quarterly motor-industry growth as a base effect against the still-disrupted final quarter of 2025. A revisable May 2026 vintage. A rebound in the rate does not measure recovery of cumulative lost output.
16. [16] Office for National Statistics · Comparison of motor vehicle manufacturing output statistics, UK: 1997 to 2019 · 2020-01-10. Section 3, table 1 (measures, surveys, prices, seasonality), table 2 (division C29), and SMMT’s outputs. ONS compares its turnover-survey-based index with SMMT physical units and explains differences in coverage and processing. A 2020 methodological paper; its historical sample sizes and industry weights are not treated as current values.
17. [17] Office for National Statistics · Blue Book 2024: advanced aggregate estimates · 2024-08-07. Section 9, Wholesale and retail trade case study, first paragraph; section 7, Measuring GVA and the importance of intermediate consumption. For wholesalers and retailers, trade service output is the margin between sales and the cost of goods sold. Definition of trade service output; other intermediate consumption must still be deducted to obtain value added.

Original text and illustrations: l0g · CC BY 4.0. Cited documents retain their publishers’ rights.