Jaguar Land Rover Cyber-attack

Chi Onwurah Excerpts

Tuesday 9th September 2025 Commons Chamber

[Chris Bryant]

The right hon. and learned Gentleman makes a very good point about legislation that is somewhat out of date and needs renewing. That is one of the reasons why, as we stated in the King’s Speech, we will introduce a new cyber Bill. I see the Under-Secretary of State for Science, Innovation and Technology, my hon. Friend the Member for Vale of Glamorgan (Kanishka Narayan), nodding. If we do not do that properly, I am sure that the right hon. and learned Gentleman will table an amendment to the Bill when it is debated.

[Dame Chi Onwurah (Newcastle upon Tyne Central and West) (Lab)]

I congratulate the Minister on his new role. I am sorry that we never had the opportunity to welcome him to the Science, Innovation and Technology Committee when he was at the Department for Science, Innovation and Technology, but I believe I see the new artificial intelligence and cyber Minister, my hon. Friend the Member for Vale of Glamorgan (Kanishka Narayan), sitting on the Front Bench, and I look forward to welcoming and congratulating him.

The devastating JLR cyber-attack is one of a series of cyber-attacks that have been wreaking havoc on British businesses and consumers and undermining public confidence. Will the Minister confirm my understanding that neither JLR nor Marks & Spencer are deemed to be providers of essential services under cyber legislation, and are therefore not required to meet the highest levels of cyber-security and reporting requirements? If that is the case, will that change under the new cyber-security and resilience Bill, which he mentioned? If not, how will he improve cyber-resilience in our industry and society without such measures?

[Chris Bryant]

It is interesting, is it not? My hon. Friend makes a very good point. There is a balancing act for us to achieve: we do not want to overburden businesses with requirements, but we want to make sure they take every action to ensure they are properly protected. I will write to my hon. Friend if I have got this wrong, but my understanding is that those companies are not presently included. I am afraid that she will have to wait for the Bill, but our intention is that it will directly relate to things like energy and water supply—drinking water and things like that. As I say, it is a balancing act, trying to make sure that industry has the freedom to operate as it should while embodying the best practice.

One other thing I will say is that all businesses, whether large or small, should avail themselves of the early warning tool available from the National Cyber Security Centre whenever they think that they may have had an attack. It is really important that we have a real idea of the prevalence of this problem across the whole sector, and that we are able to join up the dots between different incidents.