JLR stuck in neutral as losses skyrocket amid cyberattack cleanup

Jaguar Land Rover (JLR) has announced a further extension to its multi-site global shutdown, bringing its cyber-related downtime to nearly four weeks. The carmaker said on Tuesday that staff had been informed that production will remain suspended until September 24. "We have taken this decision as our forensic investigation …

[PCScreenOnly]

Te government should apply a law that if a company such as JLR get hit like this, they are resonsible for any kind of payments to keep their supplier staff employed or on furlogh.

I feel for the people affected, but not sure why it should fall onto the tax payer to bail out.

yes, aware of banks, but you can argue banks are critical vs cars.

Then again, Bank A collapses then you have banks B and C to choose - hoping the FSA protection helps which strengthens the argument for government help.

Is JLR collapsing going to impact other car makers when their markets are different ?

An investment bank (lehman) is different to a high st and is to me in the same sort of territory.

[wolfetone]

There is a very good case to be made for a bail out to the suppliers of JLR. It isn't the fault of the supplier that their customer (quite often their sole customer due to JLR contract shenanigans) has fell asleep at their IT security wheel. Real people, often the lowest paid, are hit by this through no fault of their own either. That is roughly 100,000 people world wide losing their jobs.

I'm not sure of the number of workers in the UK affected by it, but when MG Rover went bankrupt over 760 children in the school I went to were either directly affected from a parent losing their job at MG Rover, or from a MG Rover supplier going bump after it. And we were just one school in Birmingham.

If we take an incredibly conservative figure of 1,000 people in the UK working for a JLR supplier, that's 1,000 families affected. That's 1,000 young children, teenagers, young adults, all affected by this.

[cyberdemon]

Fair point, although I think such a bailout would get more support if us taxpayers pay half, on condition that JLR and its shareholders pay the other half.

And it would need to be restricted to suppliers who are genuinely impacted by the JLR closure. No "software license suppliers", management consultants, etc.

[PCScreenOnly]

If my old Ltd company went bust as I could not get contracts, should the gvt bail me out ? no, and of course they won't

COVID and the loans then were different, but abused so badly the banks tried to stop but were told to speed them through.

If companies can continue to take risks and not worry as the "government" will bail them out, then they carry on as now. Poor decisions, huge riks, under investment. JLR should be made responsible for this.

I appreciate it is hard from reading other sources, when a supplier wants to provide x companies, but the contracts are so hard on the supplier they end up only supplying one company and this is the result (maybe do what various companies do, a large parent company and then small shell companies. Shell companies supply each manufacturer independently and pay money up the chain (see any big american corp not paying tax). Seems to work for those companies that let the lower hanging companies go bust, or via various take overs (aka, maplin). Could also give a level of protection

[sitta_europea]

" ... when a supplier wants to provide ... but the contracts are so hard on the supplier ... "

This happens everywhere.

When a potential customer sent me its terms to sign, and the terms were so onerous that I could easily see them bankrupting me, I told them to take a running jump.

The customer? Local government. Derbyshire County Council in England.

Their terms said that if they bought something from me, and then LATER found that they could have bought it cheaper somewhere else, they could come back to me for the difference.

Suppose they bought it from a bankruptcy auction?

If you agree to something like that, you must be out of your mind or bent.

[MachDiamond]

"When a potential customer sent me its terms to sign, and the terms were so onerous that I could easily see them bankrupting me, I told them to take a running jump."

I sold some repair parts to Lockheed for devices they had purchased from my company before I owned it. They took ages to pay and when they called again, I told them it would be COD. They didn't have any way to pay COD so I told them CIA and they told me they don't do that. Too bad for them since I would never offer them terms ever again. They used all of the classic check stalling techiques/lies that are taught in college courses. I was ready to open a small claims case against them the week I got a check. It would have cost them much more to defend against a small claims action than it was worth and would lose so I would have likely had a default judgement when they failed to show up. Once burnt, twice shy. The parts were made to order since the product wasn't stock and while it was a very interesting device, it was very low volume and once I got low on the parts on hand, I pulled any reference to it from price lists. One other aerospace company bought those parts from me and didn't have a problem paying a deposit and cutting a check on time. The experience taught me the pitfalls of working with a much larger company that was never going to be a long term or very valuable partner.

[Anonymous Coward]

Since MG Rover (and also LDV) was asset stripped and plant and knowhow shipped to China they seem to be able to now make half decent cars (and Maxus vans).

You’d be surprised how many MG SUV’s are driving around SE Asia.

[MachDiamond]

"That's 1,000 young children, teenagers, young adults, all affected by this."

Ah, the "think of the children" defense.

[Anonymous Coward]

Won't someone think of the children - seriously?

Some people actually believe there is a magic money tree that will save us all.

Repeat after me "there is no money".

[Alan Brown]

> It isn't the fault of the supplier that their customer (quite often their sole customer due to JLR contract shenanigans) has fell asleep at their IT security wheel

If JLR is their only customer then they aren't an independent company, they're employees at arms' length and we know how the Inland Revenue views that

[elsergiovolador]

Underinvestment in IT and outsourcing critical systems shouldn’t be seen as normal cost-cutting - it’s reckless behaviour. If companies know the taxpayer will cushion the blow, they’ll keep hollowing themselves out and treating resilience as optional. Better to let firms that gamble on fragile IT fail, otherwise we just keep socialising the losses while they privatise the gains.

[PCScreenOnly]

Ii agree, but it is not fair on the those lower down the chain who lose their jobs for no reason of their own.

I don't see why the tax payer should bail then out and put that responsiblity onto where the real problem lies - this case JLR or whatever they do the TCS (destroy them would be best)

If JLR go bust because of this (and not a fire sale to avoid any payments and start a new company tomorrow with the all the assets for £1) then there should be some government intervention, but we need to make the main culprit culpable

[snowpages]

You think life is fair?????

[elsergiovolador]

If you choose to rely heavily on a company that’s gutted its own IT resilience to save money, you’re effectively betting your business on their gamble. That doesn’t mean suppliers are the villains, but it does mean they aren’t entitled to act shocked when it blows up. Risk belongs to everyone in the chain.

[Anonymous Coward]

When you say gutted you mean outsourced/offshored to TCS (also Tata owned).

TCS … M&S, Coop …..

[MachDiamond]

"Fair" is an overused word and has no meaning in most cases where it is used.

It sucks to lose your job due to the company you work for losing business or making poor business decisions that make it necessary to let people go. The reality is that employment at a company is almost never a guarantee. I can recall one case where Twitter bought out a company and the contract required them to keep the owner of that company for a period of time after the sale. Elon came along and fired him when he bought the company and then had to buy out the remainder of his guaranteed employment term. The employment was part of the sale price and I expect it had some advantages from a tax standpoint on both sides.

If the government is going to indemnify people from losing their jobs, there will have to be a tax/fee for that. Of course, that fund will be raided for other things and might not be there to help you when you need it and won't cover much if there is any money in the account.

[katrinab]

"Is JLR collapsing going to impact other car makers when their markets are different?"

Yes. You have companies that supply a particular component to many different car manufacturers including JLR. If they go bust due to the loss of JLR business, that means the other car manufacturers are unable to get that component.

[MachDiamond]

"Te government should apply a law that if a company such as JLR get hit like this, they are resonsible for any kind of payments to keep their supplier staff employed or on furlogh."

If the supplier has put so many eggs in one basket that they can't reassign or support their staff impacted through things like this, that's their problem. It's a big reason to not have a single customer be too large of a percentage of revenue/profits. Doing that is very risky. I would imagine that the supply contracts have outs due to unforeseen issues that are out of their control. A big cyber attack would be such a thing.

[elsergiovolador]

Outsourcing IT

If you were ever weighing up whether outsourcing your IT was a good idea, Jaguar Land Rover has just published the best advert against it. Four weeks of shutdown, suppliers collapsing, hundreds of millions torched. For what?

[Anonymous Coward]

Re: Outsourcing IT

Outsourcers have a habit of delivering no more than what they are paid to deliver. If JLR paid for decent security but didn't get it, then that's on outsourcing. If, however, they chose to take the risk because "cheap" then don't blame outsourcing, blame JLR...

[elsergiovolador]

Re: Outsourcing IT

Outsourcing “delivers what you pay for” only in the narrowest sense. In reality, there are vanishingly few success stories - most end in tears. The UK market has been engineered to favour the big consultancies (hello IR35), which means they hoover up contracts while having no incentive to build real capability or upskill staff.

The entire model exists so managers can boast of “savings,” pocket their bonus, and move on before the inevitable collapse.

[MachDiamond]

Re: Outsourcing IT

"Outsourcing “delivers what you pay for” only in the narrowest sense. In reality, there are vanishingly few success stories - most end in tears."

I was just watching a report on California's HSR problems and outsourcing was a big target of the person making the video. The agency formed to oversee the project were political appointees that had almost no rail experience, there were a lot of them and they did what those agencies always do and that's hire consultants to be the brains of the outfit. Something like Gaspode being Foul Old Ron's thinking-brain dog. I don't universally rule out consulting. As Thomas Edison is famous for saying, when he needs a mathematician, he hires one. If you need one all of the time, they should be full-time and part of the organization. I talked today with a contractor I use to fix things on the house. He's much better at those things than I am and it's getting hard for me to physically do some of the work. The last time I did a big roof repair, it sidelined me for a couple of days afterwards. He's also good at showing me different options that he knows work and can be better value for money. Now that summer's ending, I have a list of things needing to get done.

[masaccio]

Re: Outsourcing IT

Maybe not. The Torygraph reports it’s a flaw in SAP.

[PCScreenOnly]

Re: Outsourcing IT

See reports of qui8te a few SAP critical errors on here, but who is responsible for the patching.... TCS or whoever decided not to allow patching to happen

[PCScreenOnly]

Re: Outsourcing IT

Just had lunch and see that this could be SAP Netweaver.

hmmmmmm,, critical 0 day patch in April 2025 (24th - 30th depending on source)...................

Bit worrying if that is it

[ChoHag]

Re: Outsourcing IT

Where or what the flaw is is largely immaterial. The system should not have been designed to fail in its entirety when one components breaks.

Don't they make cars?

[MachDiamond]

Re: Outsourcing IT

"Don't they make cars?"

It's hard to tell and given their reputation for quality over the years and many owners..........

[PCScreenOnly]

Re: Outsourcing IT

Think M&S shows that, and Co-op and the really one common factor here

You went cheap and outsourced to a cheap company - TCS

Not saying any other cheap company would fare better or worse, but TCS is really tarnished (that that it will matter to the dickheads who make decisions)

[Anonymous Coward]

Re: Outsourcing IT

Common dominator is TCS! Have it on good authority that it's a SAP issue that came from them that they well knew about as well from COOP/M&S - same exploit!!!!!

[Anonymous Coward]

Re: Outsourcing IT

Not (Tata owned) TCS again is it ?

[Captain Badmouth]

Just the start, state actor proxies dipping their toes in the water.

[John_Ericsson]

I have worked in many environments and it is chalk and cheese with companies that outsource their IT and those that don't. Outsourcing will never be able to provide the flexibility that Cyber Security requires. To request a change when outsourcing IT requires tiers of management to approve and to find funding for even the simplest of change or improvement. Those in the management tier have the direction of not submitting any change due to the expense and "leave it to the next contract". When you have your own IT staff, they are falling over themselves for projects (which is not always a good thing) and to improve services.

[goblinski]

...When you have your own IT staff, they are falling over themselves for projects (which is not always a good thing) and to improve services...

The whole thing above is as caricatural as it comes. I've seen both ends, and it's very far from what you describe. Anyone willing to settle with the type of outsourcing you describe will be willing to settle with the same level of shitty in-house service.

You don't mention whether your outsourcing experience was with local companies or overseas, but in both cases it doesn't match my experience.

There is no level of dedication, fear and panic reachable in any Western country, that can compare with the daily terror overseas outsourced support submits themselves to, neither can anyone match the realms of painstaking detail nitpicking they can reach. Combine this with a minimum of technical knowledge, and they are a safety net that can't be beaten. Add some small local team or a couple of guys for the pointy stuff, and it's a like a tank + infantry.

As for local outsourcing - the talent is to be able to find the right ones, like for everything else. I still light a candle to Saint Local Consultant who saved my behind multiple times and taught me a lot.

[elsergiovolador]

“Saint Local Consultant” belongs to folklore now. A decade ago you could still find small firms or independents who built their reputation on deep expertise and repeat business. They reinvested in training because their survival depended on quality. That ecosystem has been deliberately thinned out.

What we’re left with today are the giants - body-shops that win contracts on headcount and price, not on skill. Once smaller players were forced out, the incentives shifted: no competition on capability, only on how cheaply you can stack a support desk. Imported labour fills the gaps, and nobody is rewarded for building real resilience.

So yes, there once were consultants who could swoop in and save the day. But that era ended by design. “Saint Local Consultant” is now a bedtime story from a time when expertise actually mattered.

[goblinski]

I disagree. All the guys I used to work with are still in business. Could be the geographical specifics, but my area is ripe with people who are independent, good and in business.

[elsergiovolador]

in business

With IR35 in place, being in business is an exception.

[MachDiamond]

"To request a change when outsourcing IT requires tiers of management to approve and to find funding for even the simplest of change or improvement. "

Two sets of management. The outsourced company needs to do a study to see what needs doing and how much they'll need to charge for it. Whatever they submit will go through layers of bureaucracy and then be sent back as unapproved. Lather, Rinse, Repeat.

[goblinski]

WHAT outsourcing ?

JLR is already owned by Tata. If they deal with Tata Consultancy - it's (almost) in-house, and one way or the other - they are effectively Indian :-P

If anything was outsourced, it's their "cybersecurity hub" in Ireland.

[deive]

Can't let facts get in the way of misplaced nationalism now can we? :D

[wolfetone]

Worth remembering that when Ford sold JLR to Tata, Ford leased their software to them for a few years until it could be replaced. That was a root and branch change, and Ford were not willing to allow any of their systems to be bought, leased, or used by Tata.

[MachDiamond]

"That was a root and branch change, and Ford were not willing to allow any of their systems to be bought, leased, or used by Tata."

For large scale manufacturing, the process and workflow can be huge advantages for one company to the next much more than the what can be gleaned by taking that product apart. One of the reasons why China might have allowed and continues to allow Tesla to run their own factory in China with no domestic partner is to spy on their C&C while making them feel like they aren't being as closely watched. Every other car maker that I'm aware of must have a Chinese partner.

Ford has optimized the manufacturing of vehicles over many many years and their software will reflect much of what they have learned. I watched a video of a plant being changed over from building F-150's out of steel to bodies being made with Aluminum. The advance planning was incredible and as the last old model was wending its way through the assembly line, the equipment was powered down, removed, the area cleaned, prepped and new machinery dropped into place right behind it. Now I want to find that video again since I think it was 3-4 days for the changeover of the whole plant. The expertise to do that sort of thing is praiseworthy.

[MachDiamond]

"If they deal with Tata Consultancy - it's (almost) in-house, and one way or the other - they are effectively Indian"

That can depend on how different business units interrelate and the way executive bonuses are calculated.

One company that supplied an employer of mine would send us non-functional product towards the end of a quarter so "manufacturing" could hit the numbers that triggered bonuses. Things we had to send back went to "warranty repairs" which as a different fiefdom. It meant plenty of work for me as I needed to unbox everything and do a complete check. This was for some sophisticated communications test equipment. Often enough I had to make configuration changes to the gear for our own customers so it needed to be unboxed anyway.

[Sam not the Viking]

Disaster Recovery Plan

Well, this must be the point that their tried, tested and proven Disaster Recovery Plan is dusted off and implemented.

If there isn't one, and it doesn't appear that there is, the directors must all be set for the high-jump. It's not as if this "No-one could have expected this to happen!". They are clearly not the right people to re-start the business. I wonder if they are still being paid?

[ChoHag]

Re: Disaster Recovery Plan

> I wonder if they are still being paid?

That's a stupid question.

I'm sorry to call it out but are you really wondering if the *directors* of a corporation are being paid?

[John_Ericsson]

Re: Disaster Recovery Plan

There most definitely will be a DSR. It will state "restore from backup" and give a timeline of essential services being available in "days". I fully expect it would have been tested several times.

[MeeDeeCee]

Confused as they currently are not taking new orders for cars due to a brand reset so what was being manufactured?????

[ParlezVousFranglais]

The clue is in the name: "JLR" = Jaguar Land Rover - so Land Rovers then...

[Chinamissing]

So the Hackers were no good, it is entirely the Management?

Reading the comments above here you would think that the hackers did absolutely nothing and were entirely the beneficiaries of the evil company management. Clearly the public sector is filled with the best and the brightest, who work long hours and heroically throughout the day and night to deliver the incredible services that we in the UK benefit from. We should nationalise everything immediately, it worked so well for the USSR and Cuba, let's do it.

I am not saying that security decisions that were made were the best (and frankly none of the posters here really know much about what happened) but the tirade of abuse about the company and demands that the company pays for all the suppliers is ridiculous. Not one comment on the hackers and the damage they did? Not one comment demanding that they are hunted down and any funds they made (I believe they have retired now to live on their golden earnings) be paid to the suppliers and workers that go bust? Seriously?

[Sam not the Viking]

Re: So the Hackers were no good, it is entirely the Management?

Hackers were able to get into a poorly-protected system. Of course they need to be found and brought to book, but that's not really the news story?

High-profile companies bask in the praise for their great achievements. When they are found wanting, they have much further to fall. Rather than having strong (let's say adequate) security and necessary fall-back procedures, the company and especially the management, has been found to be rather inadequate.

As for living the life of Riley on their ill-gotten gains, there's no indication that the ne'er do-wells have been paid a bean? Had they chosen a different path, they might have made good, honest money by preventing such attacks.

[Chinamissing]

Re: So the Hackers were no good, it is entirely the Management?

There are lots of indications that the hackers have made money from their attacks around the world and given their skills, perhaps led a nicely brought up life (or not, supposition on both sides) but decided that Lolz were more important and fun than long hours, high tax for minimal return or support.

I totally agree that when companies fail then they should be held accountable but most of this discussion board is a lot of people ranting about the evil management but based on not a huge amount of information. These particular hackers seem to be pretty special at what they do and have now got into a US bank after taking out various other companies. I would suggest that this is not a case of 'evil management' but of it being easier to be an attacker who needs to find one flaw in monumentally complex systems and then escalate from there. Than a defender trying to hold it all together, sure the management might not have budgeted enough and perhaps that will be the learning, however what is enough? How much do you need to put in before prices have to rise (or you don't give your staff the pay rise they want to cover these rising costs?)

[Anonymous Coward]

Re: So the Hackers were no good, it is entirely the Management?

You do realise the country is at war with the likely perpetrators?

[Anonymous Coward]

Re: So the Hackers were no good, it is entirely the Management?

JLR recipient of a £1/2bn bung from Rishi Sunak to build a battery Giga-factory in the automotive back-water of Tory Somerset… nowhere near any of their factories.

[Sparkus]

well...

are the executives still being paid?

[Taliesinawen]

Got in through a bug in the Web Interface

SAP NetWeaver 0-Day Flaw Actively Exploited to Deploy Webshells

“When exploited, it allows unauthenticated attackers to upload arbitrary malicious files via specially crafted POST requests to the endpoint /developmentserver/metadatauploader.”

[JamesTGrant]

Re: Got in through a bug in the Web Interface

Is it by setting the http request header referrer to ‘/loggedOutOk’?

[Boris the Cockroach]

10%

Thats the limit of exposure to any one customer .. as laid down by the boss after he (and the company) had its fingers burned when a well known manufacturer went down the toilet.

Its a pain as 3 of our customers would love to use us more... but that all he wants to risk.

As for bail outs...... wasn't a sign of one for us (or our rival sub-contractors) when the big company fell down.... we guessed correctly that perhaps if we and them were located in the city of London, the tory government of the time would have noticed and bailed us out... as they did to the banks.....

[hmas]

Complex supply chain

Those people saying tough luck/shouldn't have put all your eggs in one basket/etc... are failing to grasp the complexity of the supply chain. There are agency cleaners, security guards, plant engineers, JIT parts supplies, delivery drivers many of whom are relying on timely payment of invoices. This isn't a case of a customer having gone bust/into administration. It's a customer that has just 'stopped' and an assumption that at some point in the near future will 'start' again.

The impact of this is to remove money from the local economy and the ripple effect will be huge.

As cyber incidents become more and more common, the government does need to look at how it ringfences money from the private sector to pay for situations like this.

[JonGH]

Obviously this cyber attack is concerning for JLR but maybe not as drastic as being made out. Car plants (including JLR) often enforce their own shutdowns for many weeks as they will have excessive stock they need to sell first before and stock piling too many extra cars.

Where JLR will be feeling the pain is other IT systems which relate to car registers and anything that is related to sales.

[Anonymous Coward]

Telecoms Security Act

I hate to say this, but that little bit of legislation is starting to look a little narrow. Competing for UK contracts in the telco space is murder at the moment. Existing systems are audited in detail and found wanting, while filling in massive security questionnaires is all part of the competition? It's a good time to be a securocrat.

Will it make systems safer? Yes, but there's only so much that can be done to address the weakest link (short of firing them).