When shutting everything down becomes the only option available
In September 2025, Jaguar Land Rover publicly confirmed it had been the target of a cyberattack and preemptively shut down its global technology systems. The decision, covered by specialized outlets such as BleepingComputer and The Record, halted assembly lines in the United Kingdom, Slovakia, China, India, and Brazil at the same time.
According to what was publicly disclosed, production remained paralyzed for about five weeks. Critical billing, parts logistics, and dealership support systems were unavailable, and dealers began operating manually, with phone calls, spreadsheets, and improvisation. The company also reported that data was affected in the incident.
Subsequent public assessments, including from the UK's Cyber Monitoring Centre, classified the episode as the most economically costly cyberattack ever recorded in the United Kingdom, with an estimated impact on the order of £1.9 billion, roughly US$2.5 billion. The ripple effect reached more than 5,000 organizations across the supply chain, many of them midsize companies that were not attacked directly and still lost revenue.
The internal technical details of the incident are not public, and this article is not a diagnosis of what happened inside the company. The case serves another purpose: to show, with verifiable numbers, what happens when an entire operation depends on systems that can become unavailable simultaneously. The question that matters to a decision-maker is not what failed there, it's what would happen in their own environment.
Where attacks of this magnitude usually begin
Although the internal details are not public, large-scale incidents like this one generally exploit a known and recurring set of vectors. Verizon's 2025 Data Breach Investigations Report notes that the human element is involved in about 60% of the breaches analyzed. These are not exotic techniques, they are operational hygiene failures exploited patiently.
Compromised credentials and social engineering. The cheapest way into a company is rarely a sophisticated exploit, it's a valid login. A user reuses a corporate password on a personal service that gets breached, or approves an authentication request they don't recognize because their phone buzzed for the fifth time in a row. In another frequent variation, the attacker calls the support desk pretending to be an employee traveling on business and requests a password reset. From that point on, everything they do looks legitimate to the controls, because technically it is.
Unpatched vulnerabilities in exposed systems. That same Verizon report indicates that vulnerability exploitation accounts for approximately 20% of the breaches analyzed, with significant growth in edge devices and VPN concentrators. The practical scenario is mundane: a supplier portal, a remote access service, or a file server that went three months without updates because the maintenance window never fit the production calendar. Criminal groups scan the internet for these flaws in an automated, mass fashion, without regard for industry or revenue.
Lack of network segmentation. This is the vector that turns an incident into a crisis. When the administrative environment, the shop floor, the billing systems, and the workstation fleet all communicate freely with one another, a single compromised point opens the way to everything else. It's also the reason affected organizations frequently choose to shut everything down preemptively: without reliable internal boundaries, there's no way to know where the intruder stopped, and a full shutdown becomes the only containment available. The cost of that decision is precisely a global halt to operations.
Layered protection: what can be done in your environment
Endpoint detection and response, with human eyes behind it. Signature-based antivirus recognizes what is already known. EDR (Endpoint Detection and Response) observes behavior: a process that starts encrypting thousands of files, a legitimate administrative tool executed at an unusual hour, lateral movement between servers. The technology alone, however, produces alerts that no one reads at three in the morning on a Sunday. That's why proactive 24/7 monitoring, with qualified triage and the ability to isolate a machine from the network within minutes, is what turns detection into real containment.
Isolated, encrypted, and tested backups. Backup is the last asset still working when everything else has stopped, and that's exactly why attackers go after it first. The capability that matters is keeping copies outside the primary authentication domain, with immutability (data that cannot be altered or deleted for a defined period) and with at least one copy inaccessible to any compromised administrative credential. A strategy for backup and disaster recovery is only real when restoration is tested, timed, and documented.
Continuous patch management, MFA, and segmentation. Vulnerability remediation needs to be a process with an inventory, prioritization by criticality, and a defined window, not a task left to whoever has time. Multifactor authentication (MFA, verification using more than just a password) should also cover remote access, VPN, administrative panels, and service accounts, which are often left out. And segmentation separates worlds: if the production environment doesn't need to see the office network, it shouldn't see it.
Trained people and a plan that has already been rehearsed. Ongoing training with periodic simulations turns users into the operation's first sensor, and technical support needs a formal identity verification procedure before resetting any credential. Above all, a documented incident response plan answers in advance who decides to shut down what, who communicates with clients and regulators, and in what order systems come back. A plan that has never been tested is a hypothesis, not a plan.
Questions every decision-maker should be asking right now
1. Would my backups really work in a disaster like this? How long would it take for my operation to be back up?
2. Does my team have the right tools to identify and block an attack like this immediately, before it causes full-blown disaster? How am I investing in preparing my technical team?
3. How long would my company survive without access to its systems and files?
Would my backups really work in a disaster like this? How long would it take for my operation to be back up?
The honest answer only exists after a complete, timed restoration test. A backup that shows up as completed on the dashboard proves nothing: proof is restoring an entire system, with its dependencies and integrations, and measuring how many hours that takes. Without isolated, immutable copies, the backup becomes part of the target, not part of the solution.
Define RTO (maximum acceptable time until recovery) and RPO (maximum acceptable volume of data loss) per system, not for the entire company. Billing, ERP and identity directories almost never tolerate the same timeframe as a repository of old files.
Does my team have the right tools to identify and block an attack like this immediately?
A tool without operations is noise. The combination that reduces attacker dwell time is behavioral detection on the endpoint plus 24/7 monitoring with the authority to act, isolating a compromised host before lateral movement spreads. The useful window is usually minutes, not business days.
Team readiness is also a measurable investment: tabletop exercises with a total-outage scenario, phishing simulations with metrics that track progress and periodic review of the response plan. Small technical teams gain breathing room when on-call duty, triage and vulnerability management are backed by a managed IT structure, freeing the internal team to focus on the business.
How long would my company survive without access to its systems and files?
That number is financial before it is technical. Multiply revenue per hour, the cost of idle labor, contractual penalties and reputation, and compare it with the annual investment in protection. It's worth calculating the real cost of downtime before the bill arrives by way of a crisis.
It's worth remembering that the reach of an incident does not respect the org chart: in the reference case, thousands of suppliers came to a halt without having been attacked themselves. Regulations such as GDPR and LGPD also add notification deadlines that keep running while your team tries to restore everything.
If your company does not yet have an integrated layered protection strategy, consider taking a Strategic IT Assessment, with no commitment, to identify vulnerabilities before they become headlines.
Frequently asked questions
What is an immutable backup and why does it matter against ransomware?
An immutable backup is a copy of data that cannot be altered or deleted during a previously defined period, not even by an administrator. It matters because ransomware groups seek out and destroy backups before encrypting production systems. Without immutability and isolation from the main authentication domain, the backup copy tends to be compromised along with the rest of the environment.
What is the difference between traditional antivirus and EDR?
Traditional antivirus identifies threats by comparing files against signatures of already known malicious code. EDR (Endpoint Detection and Response) analyzes behavior in real time, detecting suspicious actions such as mass file encryption, privilege escalation or lateral movement between servers. That is why EDR can react to never-before-seen attacks, and its effectiveness depends on someone monitoring and responding to alerts continuously.
How long does a company usually take to resume operations after a large-scale attack?
It depends directly on whether isolated, tested backups exist and on having an incident response plan that has already been rehearsed. Large-scale public cases have recorded weeks of interrupted operations, such as the roughly five weeks of halted production reported in the Jaguar Land Rover incident in 2025. Organizations that test restorations periodically and define recovery priorities by system typically cut that timeframe from weeks to days or hours.