Jaguar Land Rover Cyberattack

Lord Sharpe of Epsom Excerpts

Tuesday 14th October 2025 Lords Chamber

[Lord Leong (Lab)]

My Lords, may I echo the words of the noble Lord about the late Lord Campbell? On behalf of the Government and this side of the House, I thank the late Lord Campbell for his public service to this country. He will be sorely missed in this House.

The National Cyber Security Centre has been working very closely with Jaguar Land Rover to provide support in relation to the incident. The NCSC response to the JLR incident is ongoing, but it is set to reduce as mediation takes place. Throughout the event, the NCSC has been capturing feedback to inform national and internal incident management practices. The NCSC will participate in a cross-government “lessons identified” process to review how best to improve the Government’s response, share information across partners and react to some of the unique pressures, such as those that the noble Lord mentioned. The NCSC would be happy to share aspects, depending on classification, of this process with noble Lords and other Ministers once it has been conducted.

[Lord Sharpe of Epsom (Con)]

My Lords, according to the National Cyber Security Centre’s latest report—and following on from the noble Lord, Lord Fox—in the year to September, there were 18 highly significant attacks, meaning attacks with the potential to have a serious impact on essential services. Given the increasing frequency of these attacks, can the Minister reassure the House that the Government’s plans for a centralised national digital ID database would not create a single point of potential failure, one breach away from exposing the entire British public to foreign espionage, hostile state interference or domestic data misuse?

[Lord Leong (Lab)]

I thank the noble Lord for that point. As far as private enterprise is concerned, the Government will not interfere in what private business organisations do. However, government can produce the tools and the guidance so that companies can have a more robust and resilient approach to cyberattacks. For example, the Cyber Governance Code of Practice shows a board of directors how effectively to manage the digital risks to the organisation. As I said earlier, all companies, if they have not done so, should conduct a comprehensive risk assessment of their digital and cybersecurity framework. They should apply for Cyber Essentials certification or the various other forms of certification and ensure that they have appropriate cyber insurance.