The Indonesia Cyber Security Landscape 2024 report from the National Cyber and Crypto Agency (BSSN) recorded 330,527,636 traffic anomalies in 2024, with the highest monthly count in December (112,085,045) and the lowest in May (12,273,078). The top three types were the Mirai botnet with 81,286,596 anomalies, Generic Trojan RAT with 30,914,047 and phishing sites with 26,771,610 (Nurhakim, 2025). Traffic anomalies are not the same as successful attacks, but the figures show how much pressure digital systems in Indonesia are under.
This month offered a picture of what happens when an attack does get through to a manufacturer. Jaguar Land Rover (JLR), the British carmaker, halted production from early September 2025 after a cyber incident. This case study is built from the company's official statements up to 25 September 2025. No official investigation report is available, and the company has not disclosed how the attack happened, so this article does not speculate about the attacker or the method of entry.
What Happened
On 2 September 2025, JLR said it had been impacted by a cyber incident and had taken immediate action by proactively shutting down its systems. At that stage it said there was no evidence that customer data had been stolen, but retail and production activities had been severely disrupted (Jaguar Land Rover [JLR], 2025a). On 10 September, its ongoing investigation led the company to believe that some data had been affected, and it informed the relevant regulators while forensic work continued (JLR, 2025b).
On 23 September, JLR extended the pause in production until Wednesday 1 October 2025 while it built a timeline for a phased restart with cybersecurity specialists, the UK's National Cyber Security Centre (NCSC) and law enforcement (JLR, 2025c). Two days later it announced that sections of its digital estate were running again, that invoicing capacity had been increased to clear the backlog of supplier payments, and that its global parts logistics centre was returning to full operations (JLR, 2025d).
Reading It Through CSF
We used the NIST Cybersecurity Framework 2.0, which groups cyber risk management into six functions: Govern, Identify, Protect, Detect, Respond and Recover (National Institute of Standards and Technology [NIST], 2024). From the official statements, only two of these can be read with any clarity.
Under Respond, proactively shutting systems down is a containment step that limits spread but stops production at once (JLR, 2025a). Under Recover, the order of restoration reveals priorities: invoicing, supplier payments and parts logistics came back before the production lines (JLR, 2025d). We read this as business dependency mapping being used to sequence recovery.
Govern, Identify, Protect and Detect cannot yet be assessed. The cause, the point of entry and the controls that failed have not been disclosed, and it is not known whether production control systems were affected. What can be concluded is limited: more than three weeks after the incident, production was still stopped (JLR, 2025c), so the largest impact came from the length of recovery.
The statements also reveal a supply chain dimension. CSF 2.0 places cybersecurity supply chain risk management within the Govern function (NIST, 2024). JLR's statements were repeatedly addressed to colleagues, suppliers and partners, it said its retailers remained open (JLR, 2025c), and clearing the backlog of supplier payments was among the first recovery priorities (JLR, 2025d). In our view, this shows that the impact of a cyber incident at a plant does not stop at the factory gate but spreads to suppliers who lose orders and cash flow.
Lessons for OHS
This case is not about a workplace injury, but it matters to plants that are digitising their OHS systems. Many permits to work, LOTO registers, inspection checklists, gas detector records and contractor inductions now run in apps. In our view, business continuity plans need to answer what happens to safety processes if those apps are unavailable for weeks. The statement that some data had been affected (JLR, 2025b) also matters, because digital OHS systems often hold workers' medical surveillance results, accident records and contractors' personal data. The steps we suggest:
- Keep manual permit to work and LOTO forms ready for immediate use, with clear rules on who may approve them.
- Hold offline copies of emergency contacts, safety data sheets and personnel lists for evacuation.
- Add a digital system outage scenario to emergency drills.
- Treat restarting after a long shutdown as non-routine work that needs pre-start checks.
- Involve IT and HSE together when deciding the order in which systems are restored.
How Nusa Safety Helps
Nusa Safety helps companies design HSE digitalization that keeps fallback procedures for when systems fail, and develops custom HSSE software that fits each company's processes. The Nusa Safety team also runs emergency preparedness training and drills that can include a digital outage scenario.
This article is general information and not legal or professional advice for any specific case.
References
- Jaguar Land Rover. (2025a, September 2). Statement on cyber incident. JLR Media Newsroom. https://media.jaguarlandrover.com/news/2025/09/statement-cyber-incident
- Jaguar Land Rover. (2025b, September 10). Statement on cyber incident. JLR Media Newsroom. https://media.jaguarlandrover.com/news/2025/09/statement-cyber-incident-1
- Jaguar Land Rover. (2025c, September 23). Statement on cyber incident. JLR Media Newsroom. https://media.jaguarlandrover.com/news/2025/09/statement-cyber-incident-4
- Jaguar Land Rover. (2025d, September 25). Statement on cyber incident. JLR Media Newsroom. https://media.jaguarlandrover.com/news/2025/09/statement-cyber-incident-5
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
- Nurhakim, F. (2025, August 26). BSSN: Phising modus yang banyak ditemui, warga diminta waspada [BSSN: Phishing is a common method, the public is urged to stay alert]. Bloomberg Technoz. https://www.bloombergtechnoz.com/detail-news/81920/bssn-phising-modus-yang-banyak-ditemui-warga-diminta-waspada/2
