A Cyber Attack Is a Business Problem: Real Cases That Halted Operations

Cyber attacks now lead to much more than data loss. They stop factories, send shops back to pen and paper and cut off sales for weeks. The major cases of recent years show that cybersecurity is a business continuity issue in its own right, well beyond the scope of an IT project. In this article we look at real cases that halted operations and the lessons they share.

Jaguar Land Rover: production stopped for weeks

The British carmaker Jaguar Land Rover felt the effects of its 2025 cyber attack for months. According to the results the company published:

• Third-quarter sales fell 25.1 percent year on year to 79,600 vehicles.
• Deliveries to dealers fell 43 percent.
• Production stopped for weeks, and sales relied largely on existing dealer stock.

The UK's Cyber Monitoring Centre described the incident as the most economically damaging cyber attack in the country's history and estimated its impact at around £1.9 billion.

Marks & Spencer: a breach through a third party

The retail giant Marks & Spencer's website and online sales were down for at least six weeks. Stores had to work with pen and paper, and the loyalty programme and contactless payments were out of action. The company said the impact on operating profit would be around £300 million. The shares lost value, customers filed group data privacy claims, and shortly after the systems came back the executive in charge of digital stepped down.

Rather than attacking the company directly, the attackers got in by manipulating a third-party contractor. In the same period other British retailers such as Co-op and Harrods were also hit. Co-op reported an impact of around £80 million.

The Louvre: audit recommendations ignored for years

Information that came out after the major theft at the Louvre pointed to serious cybersecurity neglect. According to audit findings reported in the press, some systems were still running on Windows 2000 and XP. The password for the video surveillance server was reported to be "LOUVRE", and on another system the supplier's name was used as the password.

For years, audit reports had recommended stronger passwords, up-to-date software and regular patching. These simple, fixable findings stayed untouched for years.

A 42-day silent attack

In one ransomware case whose analysis was shared publicly, the starting point was an employee clicking on a fake CAPTCHA check. After that:

• The organisation had endpoint detection and response (EDR) tools.
• All activity was logged.
• Even so, privileged accounts were taken over, the attackers moved laterally between networks, backups were deleted, data was exfiltrated and ransomware was deployed.

Total time: 42 days. The core problem: there were logs and no alerts. Collecting logs offers no protection on its own.

One attack, eight days, vehicles that would not start

Intoxalock, a US maker of breathalyser devices fitted to vehicles, suffered a cyber attack on 14 March 2026 and shut down its systems for about eight days as a precaution. During that time the devices could not be calibrated. The company had around 150,000 customers in 46 states. Drivers whose calibration fell due in that period could not start their vehicles or get to work.

A lesson from heists for cybersecurity

In a report published in 2014, the US Sandia National Laboratories examined 23 major heists from the previous 30 years. One example was the 2003 Antwerp diamond heist: a vault protected by card access, cameras, a steel door and sensors was breached.

The findings apply to the cyber world too:

• Most of the thieves had prepared for months, even years.
• Successful heists relied on patience, observation and inside knowledge more than on advanced technology.

Cyber attacks often work the same way: a long reconnaissance period, then a move at the moment people are least careful.

The shared lessons of these cases

1. A cyber incident is a business incident. Its effects show up in production, sales, the supply chain and the share price.
2. The entry point is often a person. A click, a phone call or a manipulated contractor.
3. Basic hygiene must not be neglected. Unpatched systems and weak passwords lead to the most expensive outcomes.
4. Detection takes more than collection. Logs and tools only help if someone responds to the signals.
5. Third parties are your risk. The security of suppliers and contractors is part of the organisation's security.
6. A business continuity plan is essential. Which systems come back first, who decides and how to communicate during an attack should all be settled in advance.

Frequently asked questions

---
Alongside awareness, InfoLore works with organisations to plan what to do during an attack. Get in touch to assess the human factor in your business continuity.