English edition ·
// l0g investigation · the economics of recovery
After the cyberattack
Who pays for recovery?
When systems stop, wages, invoices and payment deadlines keep coming. Eight complete analyses follow recovery funding from JLR’s factories and suppliers through insurance, shared providers and public support. The book connects the whole investigation in a continuous reading sequence, preserving the evidence and its limits.
- 8
- complete analyses
- 32
- infographics
- EPUB 3
- offline reading
01 / introduction
Recovery commits resources to the next step
A car is waiting for its buyer, a supplier for payment, a reader for a document. Completing each transaction involves operations that a cyberattack can interrupt. Opening a building or switching machinery back on leaves further work to do: restoring permissions, reconstructing an order, checking an amount or resuming exchanges with a partner. Wages and payment deadlines continue through that work. This book follows the money and the capabilities needed to make an activity usable again, from the first restored function to the resources required for the next stage.
JLR provides the starting point. On 25 September 2025, the manufacturer announced that its financial wholesale system was back online and that its capacity to invoice had increased. A phased restart of the first manufacturing facilities was subsequently announced for 8 October. Chapter one follows these separate functions within the same business. A vehicle being built, a sale being recorded and cash arriving all contribute to the operation. Their different dates also create different demands on liquidity. A manufacturing announcement therefore leads to further questions about the transactions surrounding the factory.
An original introduction opens the book and connects the eight analyses.
02 / reading journey
From factory shutdown to tested recovery
The eight complete analyses, in reading order. Each chapter remains available online with its references and limitations.
01JLR: when the factory stops
Sales systems, manufacturing and payments return in distinct stages. Published accounts trace their effects on cash flow.
02JLR: when lost orders squeeze suppliers’ credit
Fewer invoices can reduce available receivables finance. Purchase-order advances offer another route whose actual recipients require tracking.
03Cyber insurance: when the disruption comes from your customer
A customer’s outage creates a specific coverage question. Recognition of a settlement and its receipt retain their dates and contractual conditions.
04JLR: a cyberattack’s footprint in GDP
Production indices, value added and estimated costs cover different scopes. A rebound in a flow leaves accumulated lost output to be measured.
05After the cyberattack: the long road back to service
Recoverable backups leave services to be rebuilt. The British Library illuminates the work, contracts and limits of the observable cost.
06A shared provider draws its clients into the same disruption
CDK and Synnovis reveal customers depending on a shared provider. Replacement capacity and the resumption of exchanges also need a collective assessment.
07The public guarantee behind JLR’s recovery
The state guarantees part of the risk taken by banks lending to JLR. Commitment, drawdown and support reaching suppliers require separate evidence.
08The cost of a faster recovery
TSB, banking tests and public assessments offer ways to examine preparation costs and the capabilities an exercise can actually test.
03 / reference
The language of recovery
A glossary accompanies the book. These reference pages also support further reading online.
- Free cash flow
- Cash flow remaining after the investment cash outflows included in a company’s definition. The measure may contain issuer-specific adjustments. Its reconciliation, period and scope must be checked; it differs from accounting profit and the cash balance available on a given date.
- Working capital requirement
- Funding absorbed by the timing of inventories, customer receivables and operating payables. Rising inventories or receivables can use cash, while increasing payables can defer an outflow. The contents and sign of a reported measure require checking. Resuming production may require rebuilding inventory before the associated receipts arrive.
- Supply chain finance
- Arrangements in which a financier advances payment within a buyer–supplier relationship. Finance may be based on an approved invoice or, in the JLR programme examined here, a purchase order before invoicing. Eligibility, fees, the final debtor and reconciliation against the invoice depend on the agreement. An announced limit differs from an actual payment.
- Dependent business interruption
- Interruption of an insured business caused by an incident at an organisation on which it depends. Coverage follows the relationship defined in the policy: suppliers, IT providers and customers may fall under different provisions. Covered events, exclusions, time conditions and limits also depend on the contract. Provider-related wording establishes no coverage for a customer’s outage.
- Time excess or waiting period
- A time condition in an insurance policy governing when specified business-interruption losses become eligible, under that policy’s precise terms. It is distinct from a monetary deductible and a coverage limit. Its expiry establishes no date for settlement or receipt of cash.
- Value added
- The value of output less the intermediate inputs used to produce it. It measures an activity’s contribution to economic production while avoiding repeated counting of purchases between businesses. GDP is obtained by adding taxes on products and subtracting the corresponding subsidies from aggregate value added. Revenue and value added are different measures.
04 / conclusion
Making recovery open to scrutiny
Recovery becomes more precise when it names an operation. A dealer can record a sale, a supplier can prepare another order, a reader can locate a reference. Restoring each capability uses resources and changes commitments. Across these chapters, following that progress also reveals its funding: activity generates an invoice, the invoice may support borrowing, and payment releases money for another round of work. The useful question extends beyond the first restart announcement to the operation that people can complete and the resources it requires.
Several participants can carry that process. The affected company uses its cash and the credit available from banks. A supplier retains staff or reorganises working time. A specialist reserves capacity and works under a service agreement. An insurer pays a covered claim. The state may take part of the risk on a commercial loan. These roles can complement one another. Understanding their distribution in a particular case requires the terms and dates of each commitment, followed by evidence of the transactions actually undertaken.
The full conclusion connects cash flow, contractual commitments and the recovery capabilities examined throughout the investigation.
05 / sources and edition
Scope, evidence and limits
Edition dated 19 October 2026. Documentary cut-off: 19 October 2026.
The eight chapters reproduce l0g’s complete investigations, published on 18 and 19 October 2026. The book’s documentary cut-off is 19 October 2026; the earlier chapters retain their own research cut-offs. Historical facts and accounting balances retain their periods. A later ministerial statement remains a dated statement, distinct from the latest available accounts.
Text, contents, glossary and infographics are available offline. External sources require a connection. Image enlargement and displayed colours depend on your reading app.
The covers and panorama are conceptual illustrations created with AI assistance. The infographics retain the articles’ dates, units, sources and limitations.
Free, without registration, embedded scripts or tracking. Creative Commons Attribution 4.0 International.
Check file integrity
EPUB 3 · 4.7 MB · SHA-256
e5b2d0b862bb6531d2d164890c9bf9bdf0d6c9025eec875522499bbfd78ab829