Cybersecurity has become an unexpected speed bump on the road to digitalizing the automotive industry.
Recent cyber attacks on Jaguar Land Rover and Stellantis have exposed how vulnerable the sector is in its ability to deliver on the customer experience it promises to the consumers and business clients across its sprawling supply chain.
Typically, the conversation in automotive CX centers on showroom experience, mobile apps, and increasingly, infotainment systems. But behind the scenes, a vast B2B ecosystem powers the industry: OEMs, Tier 1 suppliers, dealerships, fleet operators, and logistics partners all rely on secure digital infrastructure to manage their relationships and keep things moving.
These business customers expect seamless access to portals, real-time order tracking, and reliable service delivery. When a cyberattack hits, the effects reverberate through a vast B2B ecosystem, touching business partners whose operations depend on trust and uptime.
“The recent cybersecurity breaches at Jaguar Land Rover and Stellantis highlight the threats that can disrupt the modern automotive supply chain,” Jeff Collins, CEO of WanAware told CX Today.
“These attacks underscore the significant vulnerabilities inherent in the industry's vast web of interconnected software and service partners. Together they reveal a critical industry-wide exposure; the automotive ecosystem is not only susceptible to production-halting attacks on core manufacturing but also to data breaches through its extended digital supply chain, eroding confidence, necessitating a more holistic and collaborative security strategy.”
Stellantis stated on September 21 that it had recently detected “unauthorized access to a third-party service provider’s platform that supports our North American customer service operations.”
The personal customer information involved was limited to contact information, the company said. “Importantly, the affected platform does not store financial or sensitive personal information, and none was accessed.” Stellantis notified the appropriate authorities and informed affected customers directly.
The incident raised alarms about third-party risk and the fragility of integrated platforms that underpin B2B relationships.
Jaguar Land Rover faces a different kind of breach, the effects of which are still ongoing. The automaker was hit by a cyberattack in late August, which forced the company to shut down its IT networks and suspend production at its factories in the UK, Slovakia, Brazil and India.
The company initially said there was no evidence that customer data had been stolen, but later stated that “we now believe that some data has been affected.”
The impact of the attack was so extensive that the company halted production on September 1 and subsequently delayed its restart into October, a symptom of the increasingly interconnected and automated approach to car manufacturing that can make it difficult to isolate individual systems.
The disruption has spread far beyond JLR’s factory floors. Suppliers have reported cancelled orders and delayed payments, and dealers have been left unable to access parts ordering systems or complete customer transactions.
JLR set up a help desk for suppliers and has been trying to share information on the extent of its supply chain, which may include more than 700 companies manufacturing the 30,000 parts that can make up a luxury car, the Guardian reported.
For instance, JLR is the main customer of Autins, an automotive insulation supplier, and the production halt “has had a material effect” on its operations, the company stated in its trading update on September 17.
Cando Wango, National Cybersecurity Solutions Architect at AllCovered, the IT services division of Konica Minolta, told CX Today:
“It was startling to learn that Jaguar was brought to a complete standstill a full month after its breach, with projections of another month of downtime to follow—losses compounding without a clear resolution in sight.”
“It raised pressing questions: Had their incident response plan been tested? Were disaster recovery drills conducted? Were their recovery time objectives (RTOs) and recovery point objectives (RPOs) clearly defined? It is difficult to comprehend how an organization of such stature and history could be left so exposed.”
JLR announced a phased restart of its manufacturing operations starting at its facilities in the West Midlands, UK, as well as plants in Castle Bromwich, Halewood and Solihull, UK, and Slovakia. “Further updates on the next steps of the controlled, phased restart will follow,” the company said. This gradual return to production highlights the extent of disruption caused by the cyber attack, suggesting that the incident affected critical operational systems and supply chain coordination.