The hack of British-based, Indian-owned Jaguar Land Rover (JLR) that shut down several production facilities for weeks cost the UK economy an estimated 1.9 billion pounds (roughly €2.2 billion or $2.5 billion) and affected more than 5,000 organizations, an independent cybersecurity body said in a report published on Wednesday. 

"This incident appears to be the most economically damaging cyber event ever to hit the UK, with the vast majority of the financial impact being due to the loss of manufacturing output at JLR and its suppliers," the report said. 

It noted how the lion's share of the costs hailed from the need to halt production, and warned that companies should pay more attention to operational security and to compartmentalizing so that IT weaknesses are less liable to lead to real world disruptions. 

Shut down through September

The apparent hack led to production being halted at JLR's two UK factories and its engine manufacturing site in Wolverhampton, facilities that usually combine to produce 1,000 new vehicles a day.

Many of the Tata-owned company's 33,000 employees were told to stay at home during the shutdown. Production restarted earlier in October.

Suppliers were also hit particularly hard, with some small companies almost entirely dependent on JLR as a customer for cashflow. 

The 1.5 billion pound loan guarantee issued to JLR by the British government last month was more for the benefit of these suppliers than the larger, better insulated company. 

JLR, which makes the Range Rover and Defender models, estimated during the crisis that its production supported around 104,000 jobs in supply chains across the country. 

British government officials including Chancellor of the Exchequer Rachel Reeves made several veiled comments seeming to implicate "hostile states like Russia" of involvement in the hack during the disruption, albeit without ever offering specifics. 

Pay more heed to OT, not just IT, experts warn businesses

The Cyber Monitoring Centre, an independent not-for-profit organization made up of industry specialists and funded by the insurance industry, ranked the JLR hack as a Category 3 event on a scale from one to five.

It also said in its recommendations on how to react that the industry should adapt to new cybersecurity threats. To paraphrase, it said the name of the game was increasingly safeguarding your operational technology from disruption, rather or as well as protecting information technology systems from more old fashioned attempts to steal data.

"Based on recent incident patterns, future high impact events are likely to be caused by disruptive attacks rather than by data exiltration," the report said. "Businesses and government should consider this when prioritizing risk, and corporate governance and busienss regulation frameworks should be designed to promote the building of resilient operations as well as promoting data security." 

The report also called on insurers to consider the coverage they offer companies and the need to protect smaller entities in supply chains. 

"Current insurance products typically cover direct financial impact to the insured and supplier failure, and disruptions to critical buyers can be out of scope," it said.

Edited by: Jenipher Camino Gonzalez