When the IT Systems Stopped, the Factory Floor Did Not Know What to Do Next

Jaguar Land Rover outsourced its core IT infrastructure to Tata Consultancy Services. In the summer of 2024, ransomware penetrated that infrastructure, exploiting unpatched SAP vulnerabilities. The attack vector was not the factory floor. It was the enterprise layer that the factory floor depended on for scheduling, logistics, and supplier coordination. [1]

Assembly lines at Solihull, Castle Bromwich, and Halewood ceased output. The three plants are JLR's primary UK manufacturing sites. They were not physically damaged. Their equipment was intact. What was missing was the shared IT layer that coordinated them. The operation had no tested answer to a direct question: what do we do when the coordination layer goes dark? [2]

The consequence was not a data breach. It was a production system that discovered its own operating assumptions during an outage rather than before one. Dealers worldwide, more than five thousand organisations in the supply chain, and JLR's own workforce all operated under the same uncertainty for 38 days. [3]

Annual production output fell 43.3 percent in the period covering the halt. The impact was not contained to JLR. Tier-one and tier-two suppliers operating on just-in-time inventory absorbed the disruption across four weeks of uncertainty. Dealer networks could not provide reliable delivery timelines. Manufacturing staff had no clear return-to-work signal. [3]

CFO Richard Molyneux acknowledged the financial impact publicly. The direct and supply-chain cost placed this among the most consequential manufacturing IT outages in the United Kingdom in recent years, with the disruption reaching suppliers, dealers, and export logistics simultaneously. [4]

Recovery required TCS to remediate its infrastructure before JLR could restore normal operations. The sequence was discovered in real time. There was no pre-existing runbook for IT loss at this scale, so the recovery order: which systems to restore first, how to sequence plant restarts, how to communicate to the supply chain: all were reconstructed under pressure rather than retrieved from a playbook. [1]

Manual workarounds sustained partial coordination during the recovery period but could not match the throughput of the automated systems. The 38-day duration reflects the time required to rebuild infrastructure to the point where production scheduling was reliable, not the time required to contain the attack itself. [2]

All three plants returned to production within the 38-day window. Dealer networks received confirmed delivery schedules. Supplier coordination was restored. The operation did not permanently lose any manufacturing capability, though the output deficit and supply chain disruption propagated through the quarter.

The unpatched SAP vulnerabilities were resolved during recovery, but the structural exposure remains: a shared IT dependency across multiple manufacturing sites with no rehearsed degraded-mode operating procedure. A future attack against the same or an adjacent dependency enters the same discovery loop. The operating model has not been redesigned to treat IT loss as a foreseeable operating condition rather than an exceptional one. [2]

The proximate cause was ransomware exploiting unpatched SAP vulnerabilities in outsourced IT infrastructure. The structural cause was that the manufacturing operation had no tested operating mode for the loss of shared IT systems. The 38 days were not the duration of the attack. They were the duration of the operating model's improvisation. [1]

JLR and TCS operate a shared-dependency model in which manufacturing scheduling, logistics, and supplier communication all route through a common enterprise layer. That layer had no resilience tier below full availability. Partial IT capability could not support partial manufacturing output, because no one had designed what partial manufacturing output looked like. [2]

The three pillars are one system. TOS without DAI improvises blind. DAI without PPPC produces a risk dashboard nobody acts on before the incident. PPPC without TOS writes a policy with no operational reflex behind it. The 38-day halt was the consequence of all three gaps operating simultaneously: no instrument to see the exposure, no procedure to operate through its loss, and no policy to prevent recurrence. [4]

Operon would instrument the patch state of critical enterprise dependencies as a leading signal, making unpatched exposure visible before it is exploited. It would codify a degraded-mode operating procedure for each manufacturing site: what the plant does when scheduling, logistics, or supplier coordination goes offline. It would rehearse that procedure on a known cadence. It would codify the IT obligations of outsourced infrastructure providers as enforceable standard operating procedure rather than a contractual aspiration. The objective is not to prevent every attack. It is to make the duration of any attack boring because the factory already knows what to do when the IT layer is gone. [2]