JLR: when the factory stops

After the cyberattack, who pays? · Part 1/8

At Jaguar Land Rover, invoice and sales processing regained capacity before the manufacturing restart. Read together, the company’s crisis statements, financial accounts and dealers’ disclosures reveal how long an industrial shutdown really lasts: the time needed to restore systems, rebuild stocks and bring cash back into the business.

On 25 September 2025, Jaguar Land Rover announces progress in its recovery. The financial system that processes sales to its dealers is working again. In the same statement, the carmaker explains that it can now sell and register vehicles more quickly, helping it generate cash. It also reports greater capacity to process invoices and work through overdue supplier payments. Manufacturing operations will begin their gradual return on 8 October, starting with components and individual workshops. Between those two dates, restoring an IT function already has a tangible value: allowing an available car to become a completed sale, followed by a payment. 1 5

This sequence gives the JLR case a significance that reaches beyond the story of a company brought to a halt by a cyberattack. It shows how a digital interruption can strike at several points in the same economic circuit, and why that circuit still bears the effects long after workers return to the factory floor. Following the consequences means reading production, distribution and the accounts together, while keeping track of the different periods each measure describes.

The disruption reaches the dealership

The incident dates from late August. A subsequent financial filing by Tata, JLR’s parent company, places it on 30 August 2025; JLR’s public announcement follows on 2 September. The carmaker explains that it has shut down its systems as a precaution to limit the incident’s impact, severely disrupting production and sales. The statement documents a containment decision taken in response to the incident. The publications reviewed leave open the technical sequence that led to that decision. 2 3

Images of idle production lines capture part of the problem. A dealer group’s financial disclosure reveals another, closer to the customer. In results published on 8 October, Vertu Motors describes the difficulties at its ten JLR dealerships in the UK: new cars could neither be registered nor delivered, diagnostic and parts-ordering systems were unavailable, and servicing and repairs were affected. Vertu puts the impact on its September trading profit at £2 million. That is the amount reported by this dealer group for that particular month. 7

A dealership can therefore remain open while losing access to the functions that make a transaction possible. The salesperson, the customer and the car may all be there; registration, delivery or the arrival of a required part can still depend on a service provided by the manufacturer. Vertu’s account of the operations it could no longer carry out makes that dependence visible. It also helps explain the priority JLR gives, on 25 September, to restoring its sales system and global parts logistics centre. 1 7

A few months later, Group 1 Automotive describes delayed deliveries, reduced availability of certain models and interruptions to parts supplies following the JLR incident in its annual report filed with the US Securities and Exchange Commission. The dealer group remains uncertain about the total impact. Both disclosures come from businesses directly exposed to the disruption, with interests of their own, but they extend the evidence beyond the manufacturer’s communications: the interruption crossed the boundary between JLR and its commercial partners. 8

When a car becomes revenue

A note in JLR’s annual accounts provides an essential detail for understanding the system restored on 25 September. JLR generally recognises revenue from a vehicle at the point of wholesale: the manufacturer’s sale to a dealer or another external customer, often before the sale to the eventual driver. Revenue is recognised when control of the goods transfers to the customer, generally on dispatch or delivery, depending on the contract. The accounts also describe some special arrangements, including temporarily keeping an already sold vehicle at JLR at the customer’s request. 6

The same note says that payment for vehicle wholesales is usually settled immediately, within two working days. This describes the usual payment pattern for wholesale transactions; manufacturing and the vehicle’s journey to its final user belong to other stages in the circuit. The distinction links JLR’s ability to complete wholesale sales closely to the cash it receives. A blockage at this point can therefore affect receipts quickly. 6

Method and scope

Functional illustration, without individual transaction timing. Revenue is recognised on dispatch or delivery depending on the contract; two working days describes usual wholesale settlement.

Figure fonts and licences

Figure fonts: Inter Variable and JetBrains Mono Variable, under the SIL Open Font License 1.1. Inter · JetBrains Mono.

The word “sale” thus covers two successive events, which the accounts track separately. JLR may already have sold a car to its dealer network while the final customer is still waiting for it. Dealers may also deliver vehicles from stock while the manufacturer’s production is suspended. These situations help explain why retail sales continue to be recorded in a quarter marked by factory shutdowns: vehicles already in the distribution system can sustain some activity, provided that the functions needed to sell them remain available or are restored.

JLR’s published indicators require a further distinction. Retail volumes, which measure sales to end customers, include the Chinese joint venture CJLR; the wholesale volumes used here exclude it. Subtracting one from the other would combine different reporting scopes. To examine inventory, we therefore use the movements disclosed in the cash flow accounts, while all comparisons of vehicle volumes use wholesales excluding CJLR. 6 12 13

With those definitions in place, the 25 September statement becomes much more revealing. JLR describes restoring three capabilities: processing more supplier invoices and payments, bringing its parts centre back into operation, and completing vehicle sales more quickly. These functions address three simultaneous needs: paying business partners, keeping customers’ cars on the road, and generating receipts. Restoring them can improve the position before another vehicle has been manufactured. This is the mechanism suggested by reading the statement alongside the accounting policies, without assuming that a single system controls all these operations. 1 6

Manufacturing and distribution recover in stages

Manufacturing itself returns in stages. On 7 October, JLR announces a restart beginning the following day, initially setting out plans for engine production, battery assembly, stamping, and certain bodyshop, paint and logistics operations. The statement then anticipates a return that week for the lines at Nitra and the Range Rover and Range Rover Sport lines at Solihull. A further update is to follow for vehicle manufacturing at Halewood. The list describes an industrial sequence in which the return of components and individual workshops prepares the way for vehicle assembly. 4

That wording matters when reconstructing events: 8 October marks the start of a gradual manufacturing restart. JLR’s later financial publications confirm this initial return and place the recovery of normal production levels around mid-November. The company itself therefore distinguishes the first restart from the restoration of its usual output. Several weeks of recovery lie between the two. 5 9 10

Method and scope

Dates announced by JLR; normal production resumed around mid-November. The timeline is neither daily output data nor evidence of every plant’s complete recovery.

Replenishing the dealer network then extends the recovery. In its October–December results, JLR explains that volumes suffered both from the late return of production and from the time subsequently needed to distribute vehicles around the world. The annual report draws particular attention to shipments to distant markets served by sea. A production line can have recovered its normal pace while parts of the dealer network are still waiting for vehicles made after the restart. 6 10

The revenue recognition rules introduce a necessary qualification. Depending on the contract, a wholesale sale may be recognised on dispatch or delivery, so a sea voyage does not automatically defer revenue until the vehicle reaches its destination port. At group level, JLR reports a commercial and logistical delay after production resumed. Calculating that delay vehicle by vehicle would require the contracts, the dates on which control transferred and the corresponding shipping records. 6 10

This distinction changes how a restart announcement should be read. Restoring a system, assembling the first vehicle, recovering normal output and replenishing the dealer network each represent a different kind of progress. Their sequence explains how a company can report a real improvement on the factory floor while preparing financial results that remain severely weakened. The timeline records the published milestones; without daily production data, a smooth upward curve between them would go beyond the evidence.

The trading update of 3 October 2026 returns to this lag: JLR says wholesale volumes were hit by the 2025 incident before retail sales, which suffered later as dealer inventories were depleted. That subsequent explanation reinforces the need to track the two channels separately. This investigation’s charts remain limited to the year ended March 2026. 20

The financial trough comes during the recovery

JLR’s financial year runs from April to March. The July–September 2025 quarter therefore includes two months before September’s industrial disruption, while October–December covers the factory restart, the recovery of output and the beginning of worldwide replenishment. These accounting periods explain part of the gap between the public chronology of the crisis and its financial consequences. 11 12 13

Wholesales fall from 66,165 vehicles in July–September to 59,149 in October–December, both excluding CJLR. Revenue drops over the same period from £4.900 billion to £4.538 billion. In the quarter when production gradually returns to normal, both measures are therefore below the previous quarter’s levels. JLR’s account of the distribution timetable helps explain this result; it is the manufacturer’s explanation, consistent with the dates and figures it publishes. 12 13

Method and scope

Nominal £ million; wholesales excluding CJLR. January–March: 95,315 vehicles calculated by subtraction. The £1m difference between quarterly revenues and annual revenue is retained. Annual FCF is −£2,229m; these figures do not measure the net cost of the attack.

Free cash flow (FCF) deepens the contrast: an outflow of £791 million in July–September, followed by £1,509 million in October–December. Under JLR’s definition, this measure brings together cash from operations, automotive investment and the financing costs included in its calculation. It indicates the cash the business consumes or generates after those expenditures, within the scope set out in the accounts. Its movement therefore also reflects investment and changes in inventories, receivables and operating payables. 12 13

Including the first quarter in the chart is essential to interpreting these figures. Between April and June 2025, before this incident, free cash flow was already negative by £758 million. JLR documented, among other factors, the effect of new US tariffs and adjustments to its shipments. In subsequent results, it continued to cite tariffs, the planned withdrawal of older Jaguar models and worsening conditions in the Chinese market as pressures on the business. A year-on-year comparison can measure an observed change; attributing that change solely to the cyberattack would require a separate analysis built on a credible estimate of what would otherwise have happened. 11 10

From January to March 2026, JLR returns to positive free cash flow of £829 million, with revenue of £6.870 billion. That rebound is the result for the period following two quarters of severe disruption. It leaves the full year with negative free cash flow of £2.229 billion. The four quarters show the scale and persistence of the financing requirement, while leaving open how many delayed sales were eventually recovered and how many were permanently lost. 14 6

Stock cushions the blow, then needs replenishing

The cash flow presentations help trace what happens between manufacturing and payment. In July–September, inventory movements make a positive contribution of £634 million to the cash flow presented by JLR. In October–December, the same line contributes a negative £795 million. The sign reverses: in these accounts, inventory releases cash in one quarter and absorbs it in the next. 12 13

Method and scope

Aggregate cash effects in nominal £ million. Inventories: +634 in July–September and −795 in October–December; trade payables: −1,125 in the first of these quarters. Several factors may contribute to these movements.

The mechanism is tangible. When a business sells goods already in its system while slowing their replacement, some of the money tied up in stock can return as cash receipts. Rebuilding that system then commits resources to parts, production operations and vehicles destined for the dealer network. Some of the spending comes before the sale that will recover the money. This describes how an operating cycle works; JLR’s published figures show the change in direction across two quarters. They cover the group’s inventory movements as a whole, however, and may reflect several influences.

Working capital connects inventories and receivables with operating payables. Payment obligations to suppliers form the other side of this timetable. JLR’s table assigns a negative cash effect of £1,125 million to the movement in trade payables in July–September. Invoices for earlier purchases can fall due while new orders or production are slowing. This mechanism helps explain the cash consumption associated with a reduction in operating payables. Here, it is an interpretation of the aggregate movement: the public accounts provide neither a supplier-by-supplier breakdown nor a complete account of its causes. 12

The payment systems themselves recover gradually. On 7 October, JLR says it has been making manual payments and is restoring automated payments that week. That helps explain the significance of its 25 September announcement about processing arrears: restoring IT also changes the speed at which money leaves the company, just as it is trying to bring more in. Some operations can continue through contingency arrangements, at a different capacity and pace. 4 1

The need for finance can therefore remain substantial during a real recovery. Goods have to be put back into the system and obligations settled while the associated receipts arrive progressively. That timing gap makes it useful to compare inventory movements with free cash flow. It explains why the return of productive activity and the recovery of the cash balance follow different paths, while preserving the distinction between an accounting movement and an expense directly caused by the attack.

The £260 million in exceptional charges

The annual report identifies £260 million of exceptional charges relating to the cyber incident for the year ended 31 March 2026. This comprises the £196 million reported with the July–September results and £64 million in the following quarter. The note on exceptional items refers, among other things, to claims and obligations involving third parties and to professional fees. It also explains management’s classification: recurring improvements to IT infrastructure and cybersecurity, together with indirect effects such as lost production or development time, remain within underlying operations. 6 5 10

The £260 million therefore answers a specific accounting question: which incident-related charges has JLR identified as exceptional? The figure is useful because its scope is described. Other economic effects of the shutdown sit outside that category, and the amount itself is not a record of payments made from a bank account. An expense may be recognised before it is paid, while an investment may consume cash but enter the income statement on a different basis. Reading the cost of the crisis requires keeping those timelines separate.

The decline in revenue, the loss in earnings, exceptional charges and free cash flow consequently answer different questions. Adding them together would create overlaps and mix missing business with expenditure and temporary financing needs. Establishing the incident’s net economic cost would require, among other things, separating postponed sales, lost margins, additional spending, costs avoided during the shutdown and any recoveries. The publications used here allow several of those effects to be followed with varying degrees of precision; they do not provide a complete reconciliation.

The distinction matters beyond careful wording. A supplier waiting for an invoice to be settled faces a cash requirement even if the receivable is eventually paid. A sale that disappears permanently produces a different kind of loss. The manufacturer may finance the first situation through temporary borrowing, while the second reduces the resources it can earn from its business. Understanding who pays means following those paths through to their outcome before assigning an overall price to the crisis.

The money has to last longer than the shutdown

On 28 September 2025, the UK government announces a guarantee intended to enable up to £1.5 billion in bank financing to support JLR and its supply chain. In its November results, JLR confirms that it secured a commercial loan guaranteed by UK Export Finance in October, alongside a £2 billion bridge facility signed in September. The carmaker is expanding the financial resources available to it during the restart. 15 5

The results presentation published on 14 May 2026 adds a revealing detail: at 31 March 2026, the £1.5 billion facility guaranteed by UKEF was still fully available and undrawn. It was included in available liquidity alongside other committed credit lines. The announced amount therefore describes borrowing capacity supported by a public guarantee. Following the sums actually borrowed, or the risk eventually borne by the state, requires further examination of drawdowns, repayments and the guarantee’s terms. 14

Later public disclosures underline why each observation needs a date. The 13 August results still show the facility as undrawn at 30 June 2026. On 9 September, minister Blair McDougall told the House of Commons that the guarantee remained in place and JLR had not yet drawn on the financing. This is a dated parliamentary statement, rather than a bank balance observed on this investigation’s publication date. 21 19

The shutdown’s effects also appear in a measure outside company accounts. In its first estimate, published on 13 November 2025, the Office for National Statistics reported a 28.6% monthly fall in September in the seasonally adjusted production volume index for the UK “motor vehicles, trailers and semi-trailers” industry. The ONS referred to work by the Society of Motor Manufacturers and Traders, which cited both the cyber incident at a major manufacturer and restructuring at commercial vehicle plants. The bulletin published on 15 January 2026 revised that fall to 29.5%. These estimates from two dated releases concern a sector-wide indicator, covering more than JLR and reflecting several factors. 16 17 18

Read together, the documents reveal several roles within the business experiencing the same shutdown: containing the incident by disconnecting systems, selling to dealers, restoring output in the workshops, and financing the replenishment of the distribution system. Dealerships and suppliers face their own payment and operating deadlines throughout each phase. The restart date remains a major industrial milestone; judging when the crisis is over also means asking when cars, invoices and payments have recovered a rhythm that allows them to move together.

The second instalment follows JLR’s suppliers: from suspended orders to usable credit and the advances offered during the recovery.

Further reading

The US bankruptcy notice outage illustrates another dependency between a digital service and economic operations. The Danfoss investigation connects lost stock, maintenance and contractual responsibilities. Our analysis of Kennametal’s tungsten inventories follows the cash tied up in the operating cycle.

Limitations

This documentary investigation follows the April 2025–March 2026 accounts and the 2025 industrial incident, with context from public statements through October 2026. The documents were consulted on 18 October 2026. It brings together statements by JLR and its parent company, published accounts, dealer disclosures and official publications. Management’s explanations remain attributed to JLR; explanatory mechanisms and interpretations are distinguished from directly observed amounts. No interviews or internal documents are presented as having been conducted or obtained.

The collected sources do not allow every factory shutdown, the compromised technical architecture, the initial intrusion sequence or the incident’s net economic cost to be reconstructed. The 30 August date comes from a later financial note; 2 September is the date of the public announcement. The timeline begins with that announcement and retains “mid-November” as an approximate indication. The article takes no position on the identity of the attackers or on a possible ransom. Personal data questions fall outside this instalment’s scope; the first statements from September are not treated as the state of knowledge in October 2026.

Amounts are in nominal pounds sterling, and the quarterly series follow JLR’s April–March financial year. Fourth-quarter wholesales of 95,315 vehicles are calculated by subtracting the first nine months from the annual total; the quarterly presentation rounds the figure to 95.3 thousand. Published quarterly revenues add up to £22,912 million, compared with £22,911 million in the annual accounts. The £1 million difference is retained and disclosed because the documents examined do not explain its precise cause. Quarterly movements in individual cash flow components are not combined into an annual bridge.

Sources

Numbered references link to the documents below. The entries identify source locations, reporting periods and limitations; the text and figures explain the calculations. Sources consulted on 18 October 2026.

1. [1] JLR · Statement on Cyber Incident · 2025-09-25. 25 September 2025 statement, operational bullet points. Wholesale system restored; invoice-processing capacity, supplier-payment backlogs and parts logistics.
2. [2] JLR · Statement on Cyber Incident · 2025-09-02. Paragraph below the publication date. Public disclosure and precautionary systems shutdown; contemporaneous statement as at 2 September 2025.
3. [3] Tata Motors Passenger Vehicles Limited / NSE filing · Q2 FY26 results: consolidated financial results, note 6 · 2025-11-14. PDF p. 29, note 6. The financial note dates the incident to 30 August 2025 and confirms a phased restart from 8 October; it does not date initial entry. Direct NSE access was unavailable; checked using the filing copy hosted by Business Standard.
4. [4] JLR · JLR restarts manufacturing and introduces new financing solution to pay JLR suppliers early · 2025-10-07. “Restart of vehicle production” and “New financing scheme to support JLR suppliers” sections. 7 October announcement of a manufacturing restart beginning on 8 October; plant sequence, manual and automated payments.
5. [5] JLR · JLR performance impacted in challenging quarter · 2025-11-14. “Update on cyber incident response”; Q2 FY26 results. Recovery update, normal production levels, July–September results and £196m of exceptional cyber-related expenses.
6. [6] JLR · JLR Annual Report FY25/26 · 2026-05-21. Notes 3–5, pp. 174–179: FCF p. 174, expenses p. 177, revenue p. 178; management commentary. Revenue and payment policies, exceptional-expense perimeter, annual results and distribution lag. Published on 21 May 2026; current file path dated 16 July.
7. [7] Vertu Motors / FCA National Storage Mechanism · Vertu Motors plc: Interim results for the six months ended 31 August 2025 · 2025-10-08. Chief Executive’s Review, “JLR disruption”; Current Trading and Outlook. Ten JLR dealerships; registration, delivery, diagnostics and parts affected; £2m reported impact on September trading profit.
8. [8] Group 1 Automotive / SEC EDGAR · Group 1 Automotive: 2025 Form 10-K · 2026-02-13. Printed p. 29, JLR paragraph within discussion of OEM disruptions. Delayed deliveries, model availability and parts interruptions. SEC filing dated 13 February 2026.
9. [9] JLR · JLR Q3 sales impacted by cyber incident as previously indicated · 2026-01-05. Opening paragraphs, period 1 October–31 December 2025. Production normalised by mid-November, followed by global distribution time; preliminary rounded sales figures.
10. [10] JLR · JLR Q3 performance impacted by previously indicated challenges · 2026-02-05. Financial results and opening operational bullet points. Post-restart distribution lag, other business drivers, £64m of exceptional cyber-related expenses and quarterly results.
11. [11] JLR · JLR Q1 FY26 interim financial statements / narrative reporting · 2025-08-08. Pages 5–6, 15–17; note 2 (alternative performance measures), note 4 (US tariffs). April–June quarter preceding the incident; revenue, volumes, FCF and US tariff effects.
12. [12] JLR · JLR Q2 FY26 interim financial statements · 2025-11-14. Page 7, cash-flow bridge; p. 8, volumes; pp. 17–20, alternative performance measures and exceptional items. July–September results, volumes excluding CJLR, FCF and contributions from inventories, receivables, payables and accruals.
13. [13] JLR · JLR Q3 FY26 interim financial statements · 2026-02-05. Page 7, cash-flow bridge; p. 8, volumes; pp. 17–20, alternative performance measures and exceptional items. October–December results and cash-flow bridge: inventories −£795m; working capital & accruals −£667m.
14. [14] JLR · JLR Q4 and FY26 results presentation · 2026-05-14. Pages 6–10, results and cash flow; p. 12, liquidity; pp. 23–24, financial summary. January–March results, FCF +£829m and funding facilities as at 31 March 2026. The UKEF-backed facility remains wholly undrawn.
15. [15] Department for Business and Trade / UKEF / HM Treasury · Government backs Jaguar Land Rover with £1.5 billion loan guarantee · 2025-09-28. Announcement and explanation of the guarantee mechanism. Announcement of a guarantee intended to unlock up to £1.5bn in commercial lending; distinguish available financing, drawdowns and public payments.
16. [16] Office for National Statistics · GDP monthly estimate, UK: September 2025 · 2025-11-13. Main points; section 3, production; data sources and quality. Initial estimate: −28.6% for motor vehicles, trailers and semi-trailers output, in real terms and seasonally adjusted. A later revision is cited separately.
17. [17] Society of Motor Manufacturers and Traders · Cyber attack hits vehicle output with new risk arising from tax charge on auto workers · 2025-10-24. Opening paragraphs and commercial-vehicle production discussion. The trade body cites the cyber incident and commercial-vehicle plant restructuring. Its unit counts differ from the ONS seasonally adjusted index.
18. [18] Office for National Statistics · GDP monthly estimate, UK: November 2025 · 2026-01-15. Section 4, manufacturing output and motor vehicles industry. The 15 January 2026 bulletin revises September’s fall from −28.6% to −29.5%. This is a dated vintage, not a claim to be the latest revision as at October 2026.
19. [19] UK Parliament, Hansard · Jaguar Land Rover: Redundancies · 2026-09-09. Statement by Blair McDougall. On 9 September the minister says the guarantee remains in place and JLR has not yet drawn on the loan.
20. [20] JLR · JLR delivers growth in UK and Overseas markets, offsetting challenges in China and the Middle East · 2026-10-03. Introductory commentary. JLR explains the lag between wholesale and retail effects after the 2025 incident. Preliminary volumes in this release are not included in our charts.
21. [21] JLR · JLR delivers profitable quarter despite supply and market challenges · 2026-08-13. Q1 FY27, liquidity as at 30 June 2026. The UKEF-backed facility remains undrawn at 30 June. April–June 2026 also reflects other supply and market constraints.

Original text and illustrations: l0g · CC BY 4.0. Cited documents remain subject to their publishers’ rights.