Jaguar Land Rover secures $2B loan guarantee from UK after cyberattack

The UK government on Sept. 28 said it was backing Jaguar Land Rover (JLR) with a $2 billion loan guarantee to support the nation’s auto industry supply chain in the wake of a devastating cyberattack.

First reported on Sept. 2, the cyberattack on JLR forced the automaker to shut down production and has cost the company at least $4.7 billion in damages.

Automotive News Europe reported Monday that JLR will resume some of its manufacturing operations in the next few days.

“This cyberattack was not only an assault on an iconic British brand, but on our world-leading automotive sector and the men and women whose livelihoods depend on it,” said UK Business and Trade Secretary Peter Kyle. “We’re backing our automotive sector for the long-term through our modern industrial strategy and the landmark trade deals we’ve signed to boost exports.”

Some security pros were concerned that by announcing the loan guarantee, the UK would open itself up to other attacks.

“Personally, I think the UK is going to be the one to watch now,” posted Kevin Beaumont, a noted security researcher. “If I was an e-crime actor, I’d zero-in on the UK … It’s all the wrong messages being broadcast. Strap in.”

On the other hand, Lawrence Pingree, technical evangelist at Dispersive Holdings, pointed out there have been a few times in history that bailouts have been done for cybersecurity breaches.

Pingree said for example, during the WannaCry breach the UK’s National Health Service (NHS) allocated trust funds for the response. Some of the investment by the NHS in the aftermath of WannaCry included a $27.55 million fund for trauma centers and $196.8 million over three years for broader security improvement.

“FEMA in the United States has allocated response funds in the past to [state and local governments] to deal with incident response for ransomware attacks,” said Pingree. “But the use of government funds vs. cybersecurity insurance is paltry in comparison, with many thousands of cases of cyber insurance funds used. Automotive manufacturers tend to be prioritized by local governments due to their national security implications to transportation and competitiveness.”

John Bambenek, president at Bambenek Consulting added that the core cybersecurity issue here is that national governments have failed to create a system in which they consistently punish cybercriminals.

“Therefore, it makes sense that when a cybersecurity breach has severe economic damages, the government must come in to help mitigate a problem they are somewhat — though not totally — responsible for,” said Bambenek.