How one attack exposed the next frontier of cyber risk — and why quantum security readiness cannot wait.

What Happened at JLR and the Supply Chain Fallout

In September 2025, Jaguar Land Rover (JLR) was forced to halt UK and global factory operations after a major cyber attack that crippled its IT and logistics systems.

• Production stoppage — Estimated losses exceeded £30–40 million per day.
• Supply chain ripple effects — Over 100,000 UK jobs in the automotive supply chain were disrupted. SMEs supplying parts faced cancelled orders and severe cash-flow strain.
• Government involvement — To mitigate systemic risk, the UK government stepped in with a £1.5 billion loan guarantee, backed by UK Export Finance, expected to unlock commercial lending to bolster JLR's liquidity.
• Commercial backing — In parallel, JLR secured a £2 billion emergency credit line from a consortium of international banks, intended as a liquidity backstop over an 18-month term.
• Guarantee terms and concerns — The government guarantee covers up to 80% of the risk on the loan, over a five-year period, rather than being a direct cash injection. Some observers warn the support may be too indirect to help smaller, lower-tier suppliers quickly, who remain vulnerable to collapse if funds do not trickle down fast enough.
• Supplemental supplier support — JLR itself is reportedly preparing an additional £500 million invoice-financing facility to accelerate payments to suppliers.
• Supply chain pleas — Smaller suppliers have publicly urged the government to provide more direct support, such as loan schemes, extended tax payment deferrals, or temporary easing of insolvency rules.

The JLR breach was not an isolated event. Similar incidents at Marks & Spencer (retail) and the Co-op (supply chain disruption) have shown that critical sectors remain highly exposed to both direct and third-party risks.

Cystel's Takeaway: A single weak link can shut down an ecosystem. Cyber resilience is not just a technology issue — it is an operational and national security issue.

How Quantum Risks Tie Into Real Breaches

While JLR's attack did not explicitly use quantum techniques, it starkly underscores a dangerous convergence: the "Harvest Now, Decrypt Later" (HNDL) strategy, and how today's vulnerabilities become tomorrow's catastrophes.

The HNDL Threat: A Time-Delayed Armageddon

Attackers do not always aim for immediate payoff. With HNDL, criminals exfiltrate encrypted data now, quietly store it, and wait — knowing that once sufficiently powerful quantum computers exist, they can decrypt it long after the fact.

Harvest Now (Data Theft) → Store (Encrypted Data) → Decrypt Later (Quantum Enabled)

The mechanics of the HNDL threat:

• Stealthy & persistent — Because they cannot break it yet, adversaries do not necessarily trigger alerts or demand ransom. You may never know you have been compromised.
• Long-lived value — Data that seems "old" today, like blueprints, R&D files, intellectual property, legal and financial contracts, may still hold extreme strategic value years later.
• Encryption fragility — Current public-key schemes (RSA, ECC) are vulnerable to quantum attack. Once quantum decryption becomes feasible, the protective shield around today's encrypted data collapses.

In short, data stolen today under secure encryption might be fully exposed tomorrow.

Why This Risk Is Already Real (Not Just Theoretical)

• Intelligence and industry warnings are already clear: organizations are being urged to begin PQC migration now, not when quantum capability finally arrives.
• Some sectors (defense, critical infrastructure) are particularly susceptible, because the shelf life or sensitivity of their data spans decades.
• The very posture of HNDL makes detection and attribution extremely hard until decryption is achieved — by then the damage is irreversible.

Year	Estimated HNDL Risk Level
2025	20%
2027	40%
2030	70%
2035	100%

Connecting Back to JLR & Supply Chains

JLR's breach illustrates how an IT intrusion can cascade into a systemic crisis. But what if, in addition to immediate disruption, an attacker also harvested encrypted design files, contracts, or supplier data for future decryption?

Suppliers and sub-tiers are especially vulnerable — many may not have the resources to adopt PQC early. That data, exfiltrated in a "quiet" move today, could be decrypted later to reveal sensitive engineering, contractual, intellectual property or financial information.

Why PQC Matters Right Now

Post-Quantum Cryptography (PQC) is the next evolution of encryption — designed not just to resist today's attackers, but also those wielding future quantum computing power. It is not just theory; it is the next front in securing what we build today.

In July 2022, the U.S. agency NIST published draft PQC standards, selecting algorithms such as CRYSTALS-Kyber for encryption and Dilithium for signatures. IBM researchers played a key role in developing two of these standards (ML-KEM for Kyber, ML-DSA for Dilithium).

IBM has also produced research on implementation challenges and possible attacks against PQC schemes (e.g. side-channel or fault injection methods), which underscores that migrating securely requires more than just swapping algorithms.

Beyond NIST, other regulatory and standards bodies are moving too:

• The European Union's ENISA has published reports on PQC and is expected to align future EU encryption guidance with NIST's selections.
• In the U.S., executive directives like Executive Order 14028 and National Security Memoranda already push federal agencies to inventory cryptographic systems and plan transitions toward PQC.
• Globally, multiple countries (e.g. Canada, Australia, Japan) aim to adopt PQC or align with NIST's approach, creating cross-border consistency requirements.

Attribute	Legacy (RSA/ECC)	PQC
Security Strength	3 / 5	5 / 5
Quantum Resistance	1 / 5	5 / 5
Longevity	2 / 5	5 / 5
Adoption Readiness	4 / 5	2 / 5

The Stakes: Where We Stand

• Only 12–15% of UK organisations have begun PQC pilots (per NCSC surveys).
• Over 60% still depend solely on classical encryption (RSA, ECC), putting their long-lived data at risk once quantum decryption is viable.
• In mission-critical industries (automotive, aerospace, healthcare, national infrastructure), data such as designs, source code, contracts, and patient records must survive decades, making PQC not optional, but essential.

For firms like JLR, whose operations sit at the intersection of IP, supply chains, and connected systems, failure to act on PQC is a strategic vulnerability. The move is not about chasing hype — it is about future-proofing what you create today.

The Role of Quantum Risk Assessments

A Quantum Risk Assessment (QRA) is the first real step organisations can take to understand how exposed they are to the coming wave of quantum threats. It is not just about encryption — it is about visibility, prioritisation, and readiness.

A well-run QRA helps leaders answer three simple but critical questions:

1. What data would cause the most damage if decrypted tomorrow?
2. Where does that data live — internally and across suppliers?
3. What needs to change today to stay secure in five or ten years?

Quantum risk is complex because it spans people, processes, and technology. The assessment process breaks that complexity down into manageable layers.

1. Data Mapping — Knowing What Is at Stake

Most organisations underestimate how much long-life data they hold: vehicle designs, software source code, manufacturing recipes, defence blueprints, or legal contracts — information that will still matter years from now. Mapping this data means identifying where it is stored, how it is shared, and how long it needs to remain confidential. In JLR's case, detailed design files and connected vehicle data flowing across suppliers are perfect targets for attackers adopting the "Harvest Now, Decrypt Later" approach.

2. Crypto Inventory — Understanding Your Current Defences

Every business uses multiple encryption systems in VPNs, emails, databases, IoT devices, or cloud platforms — often without a central record. A crypto inventory catalogues all algorithms, keys, and certificates in use, noting which depend on RSA or ECC and will eventually fall to quantum attacks. This step creates the foundation for crypto-agility: the ability to swap out algorithms quickly when standards evolve.

3. Threat Modelling — Seeing How You Could Be Targeted

This stage analyses potential risks such as HNDL attacks, insider misuse, or compromise through third-party integrations. For instance, if a supplier's email archive containing design documents was breached today, that stolen data could be decrypted years later once quantum tools become viable. Threat modelling helps organisations identify where encryption gaps exist and how data might move beyond their control — a key lesson from the JLR incident.

4. Regulatory Alignment — Staying Ahead of Compliance

Quantum risk is now appearing in policy documents worldwide:

• The UK's NCSC advises early migration to quantum-safe algorithms and mandates crypto-agility for critical national infrastructure.
• The U.S. NIST and NSA have issued formal timelines for federal PQC adoption by 2030.
• The EU's ENISA and DORA frameworks for finance and operational resilience both reference encryption modernisation as a core requirement.

Aligning a QRA with these evolving standards ensures organisations meet both regulatory expectations and client due diligence requirements, especially in sectors like finance, healthcare, defence and automotive manufacturing.

5. Migration Path — Building the Road to Quantum Readiness

Once exposure is clear, the QRA develops a step-by-step migration roadmap. This includes prioritising "crown-jewel" assets for early PQC pilots, upgrading cryptographic libraries, testing hybrid encryption models ("classical + quantum-safe"), and embedding PQC requirements into vendor contracts. Organisations can then integrate these changes into broader digital transformation or security modernisation programmes without business disruption.

Cystel's Takeaway: The JLR breach proved that resilience is not only about firewalls and backups. When attackers can disrupt production and ripple through thousands of suppliers, quantum risk becomes both a cybersecurity and an economic issue.

A Quantum Risk Assessment provides the visibility needed to act early, not react late. It helps you see your true exposure, plan your migration, and safeguard the trust that keeps your ecosystem moving.

Practical Steps Organisations Can Take

Step	Action
1. Start Crypto Agility	Design systems that allow fast swapping of cryptographic algorithms.
2. Run Quantum Readiness Assessments	Map risks across core business and third-party dependencies.
3. Protect Long-Life Data	Prioritise PQC protection for IP, healthcare, legal, and financial data.
4. Integrate PQC Pilots	Adopt PQC algorithms in secure email, VPN, supply chain data exchange.
5. Extend to Supply Chain	Mandate PQC in supplier contracts and security reviews.
6. Board-Level Accountability	Treat quantum security as a strategic board-level risk.

Cystel's Conclusion

The JLR breach is a powerful reminder that cyber attacks today do not just disrupt IT systems — they can bring entire industries to a standstill, affect national economies, disable critical infrastructure and put thousands of livelihoods at risk.

Quantum risk takes that challenge to another level. The "Harvest Now, Decrypt Later" strategy means the data stolen today — designs, contracts, or customer records — could be unlocked years from now when quantum computers mature. What seems secure today may not be tomorrow.

The only real defence is to act early. Organisations must start building crypto-agility, run quantum risk assessments, and extend PQC readiness across their supply chains. Waiting for quantum computing to arrive is not an option — by the time it does, it will be too late to safeguard what has already been stolen.

This moment is not about fear, it is about foresight. Protecting what matters today ensures business continuity, trust, and resilience in the years ahead.

At Cystel, we believe the future belongs to those who prepare for it, not those who react to it.

Cystel's Key Recommendations

• Run Quantum Risk Assessments
• Build Crypto-Agility into Systems
• Protect Long-Life Data with PQC
• Extend Security Across Supply Chains
• Treat Quantum Risk as a Board-Level Issue

Take the first step toward quantum resilience. Cystel works with organisations to assess, prioritise, and prepare for quantum-era risks through practical Quantum Risk Assessments and Post-Quantum Cryptography (PQC) pilot programs. Do not wait for the technology to catch up — strengthen your defences now.

Start your Quantum Readiness journey today: info@cystel.org | www.cystel.org

References

• NCSC (2024) — Quantum Security Guidance. National Cyber Security Centre, UK.
• NIST (2022) — Post-Quantum Cryptography Standardisation Project (CRYSTALS-Kyber, Dilithium, Falcon).
• ENISA (2023) — Post-Quantum Cryptography: Current State and Quantum Mitigation. European Union Agency for Cybersecurity.
• IBM Research (2023) — NIST PQC Standards: Kyber and Dilithium — Building a Quantum-Safe Future.
• CISA (2023) — Quantum-Readiness and Migration Planning Fact Sheet. U.S. Cybersecurity & Infrastructure Security Agency.
• NSA (2024) — Commercial National Security Algorithm Suite 2.0 — PQC Transition Guidance.
• European Commission (2024) — NIS2 Directive and Cyber Resilience Act — Encryption & Cryptography Updates.
• UK Department for Science, Innovation & Technology (2025) — Cyber Security Breaches Survey 2025.
• Financial Times (2025) — JLR Secures £2 Billion Credit Line as Cyberattack Fallout Deepens.
• The Guardian (2025) — Government Loan Guarantee to Support JLR and UK Auto Supply Chain.