Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes—but $220 million was not the final known figure. Jaguar Land Rover (JLR) initially reported £196 million in cyber-incident-related exceptional costs for the quarter ended September 30, 2025—roughly $220 million depending on the exchange rate. It later disclosed another £64 million for the quarter ended December 31, bringing JLR’s explicitly identified cyber-related costs to at least £260 million.
That total is not the same as lost revenue, lost profit, restoration spending, supplier losses or the full economic impact of the incident.
The short answer
The claim that the Jaguar Land Rover cyberattack cost the company more than $220 million was accurate when it appeared in late 2025, but it described only JLR’s first reported quarterly charge.
Free tools Windows power users keep installed
One-click scans. No signup required.
JLR’s November 2025 results attributed £196 million to the cyber incident. In February 2026, the company reported a further £64 million of cyber-incident costs. Adding those separately disclosed amounts produces a minimum of £260 million.
#1 Best Overall
The most precise current description is therefore: JLR initially disclosed £196 million—about $220 million—in cyber-related costs, then disclosed another £64 million. The wider financial effect was larger, but no single final all-in cost has been publicly established.
What happened to JLR?
JLR announced on September 2, 2025 that it had suffered a cyber incident and had proactively shut down global systems to contain it. The shutdown severely disrupted production and retail activity. At that point, JLR said there was no evidence that customer data had been stolen.
On September 10, the company said its investigation had found that some data had been affected and that it was notifying relevant regulators. The public statements cited here do not establish the attackers’ identity, the initial access method, whether ransomware was involved, or whether a ransom was demanded or paid.
The effects reached beyond corporate office systems. Vehicle production stopped, retail operations were disrupted, distribution was delayed and JLR’s parts-logistics operation was affected. Suppliers also faced cash-flow pressure because production schedules were interrupted.
Timeline of the disruption
- September 2, 2025: JLR publicly announces the cyber incident and global systems shutdown.
- September 10: JLR says some data had been affected.
- October 8: A phased production restart begins.
- Mid-November: Production returns to normal levels, according to JLR’s FY25/26 annual report.
- November 14: JLR reports £196 million in Q2 cyber-incident-related exceptional costs.
- February 5, 2026: JLR reports another £64 million in Q3 cyber-incident costs.
- May 2026: JLR’s full-year results show the broader effect of a difficult year, while attributing that performance to multiple factors.
JLR described the recovery as controlled and phased, prioritising customer-facing systems, vehicle-wholesale systems and its Global Parts Logistics Centre. Production restarted before distribution had fully normalised, so the financial consequences continued after factories reopened. The company’s FY25/26 annual report says the production pause lasted five weeks.
What did the original £196 million cover?
In its November 2025 Q2 results, JLR reported total exceptional items of £238 million. That amount consisted of:
| Item | Amount |
|---|---|
| Cyber-incident-related exceptional costs | £196 million |
| Voluntary redundancy programme | £42 million |
| Total exceptional items | £238 million |
The £42 million redundancy charge was separate. It should not be presented as cyberattack damage, and the full £238 million should not be described as the cost of the incident.
“Exceptional costs” are charges a company presents separately because they are unusual or considered non-recurring. They are an accounting category, not a complete inventory of every consequence. The £196 million does not automatically equal JLR’s lost sales, lost operating profit, total recovery spending or cash paid during that quarter.
Rank #3
The later disclosure takes the identified cost to at least £260 million
JLR’s February 2026 Q3 results added £64 million in cyber-incident costs for the three months ended December 31, 2025.
| Reporting period | Disclosed cyber-related cost |
|---|---|
| Q2 FY26, quarter ended September 30, 2025 | £196 million |
| Q3 FY26, quarter ended December 31, 2025 | £64 million |
| Combined disclosed amount | £260 million |
This is best called at least £260 million in disclosed cyber-related costs. It is a sum of two amounts JLR explicitly identified; it is not proof that £260 million was the final all-in cost.
Because JLR reports in pounds, the £196 million figure should remain the primary number. The “over $220 million” wording is a conversion of that original charge, not a separate dollar-denominated payment. The exact dollar equivalent depends on the exchange rate and date used.
Recommended Free Tools
Why the £310 million quarterly loss is not the attack’s price tag
JLR reported a £310 million loss before tax and exceptional items in Q3, along with revenue of £4.5 billion, down 39% year over year. Those figures show the quarter’s financial deterioration, but they cannot be assigned entirely to the cyber incident.
JLR identified several other pressures, including:
- US tariffs;
- weaker conditions in China;
- reduced volumes during the planned wind-down of legacy Jaguar models; and
- higher vehicle-marketing expenses.
The distinction matters:
| Measure | How to interpret it |
|---|---|
| £196 million Q2 charge | Explicitly attributed by JLR to the cyber incident. |
| £64 million Q3 charge | Additional cyber-incident cost explicitly disclosed by JLR. |
| £310 million Q3 loss | A total quarterly result affected by the cyber incident and other business factors. |
| Revenue decline | Lost or reduced sales activity that cannot be attributed solely to the attack. |
| FY26 profit and margin | Measures the whole year and reflects multiple operational and market pressures. |
The wider FY26 results show scale, not a single-cause calculation
JLR’s FY26 results reported:
- £22.9 billion in revenue, down 20.9% year over year;
- £14 million in profit before tax and exceptional items, compared with £2.5 billion the previous year; and
- an adjusted EBIT margin of 0.7%, compared with 8.5% in FY25.
These results confirm that JLR had a severely difficult year. They do not provide a basis for saying the cyberattack caused the entire decline. Tariffs, China-market weakness, the Jaguar model transition and other automotive-market conditions were also material factors.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Impact on suppliers and the UK economy
To ease supplier cash-flow pressure, JLR fast-tracked a £500 million supplier-financing solution that allowed qualifying suppliers to receive cash when production was scheduled. It also secured additional liquidity facilities.
The financing facility indicates that the incident had supply-chain consequences, but it should not automatically be counted as a £500 million loss. It was a financing mechanism intended to support qualifying suppliers.
Separately, coverage of a Cyber Monitoring Centre estimate put the wider UK impact at approximately £1.9 billion. That broader estimate includes effects on suppliers and other organisations, rather than representing JLR’s own accounting charge. It must not be added to JLR’s £260 million: the figures measure different things and may overlap. See ITPro’s coverage of the estimate for that external measure.
Best Value
What remains unknown?
The public disclosures cited here do not establish:
- who carried out the attack;
- the initial access vector or malware used;
- whether the incident involved ransomware;
- whether a ransom was demanded or paid;
- the final number of affected records;
- JLR’s complete insurance recovery position;
- the final all-in cost after remediation, legal and regulatory work; or
- the precise amount of lost profit caused solely by the incident.
JLR’s initial statement that it had no evidence of customer-data theft should not be turned into a definitive claim that no data was stolen, because the company later said some data had been affected. The final scope should be described cautiously unless JLR or another authoritative source provides a later definitive disclosure.
How to read the headline accurately
“JLR cyberattack cost over $220 million” is a fair description of the initial November 2025 disclosure if it is accompanied by the accounting period and currency qualification. It becomes misleading when treated as the final cost, or when it is used interchangeably with revenue losses, quarterly losses or the wider UK economic estimate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The cleanest summary separates three categories:
- JLR’s disclosed cyber-related charges: at least £260 million from the Q2 and Q3 disclosures.
- JLR’s wider financial impact: production stoppage, delayed distribution, lower volumes and profit effects mixed with other business pressures.
- The wider UK economic impact: an external estimate of approximately £1.9 billion, covering effects beyond JLR.
The Bottom Line
Bottom line: The $220 million claim was real but incomplete. JLR initially reported £196 million in cyber-related costs, then disclosed another £64 million, taking the identified total to at least £260 million. The company’s full economic loss was likely broader, but public disclosures do not reduce it to one confirmed final number.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
