Data breach detection delay

Jaguar Land Rover reported a cyber incident on 2 September 2025 and said it proactively shut down systems while its retail and production operations were severely disrupted. JLR later said its investigation found that some data was affected and it would contact anyone impacted. Public statements have not set out a confirmed timeline for when attackers first accessed systems, so any detection delay remains under investigation. Understanding dwell time and delayed breach detection can help you decide how to keep your data secure (see Protect Yourself) and support any claim with the evidence checklist. For the full overview and guidance, visit the Jaguar Land Rover Data Breach Claim hub.

This page explains why detection delay matters, the controls investigators review and what it could mean for compensation arguments alongside No Win, No Fee funding.

Delay, dwell time and why it matters

Dwell time refers to how long attackers remain inside a system undetected. The JLR investigation has not publicly confirmed a dwell time, but this is one of the first questions investigators examine because longer delays can increase the volume of data exposed and heighten the risk of follow-on scams (see What Data Was Exposed and Protect Yourself).

1. Investigators look at the timestamp of the first intrusion and when the incident was detected.
2. A longer delay can highlight gaps in logging, monitoring or alerting.
3. Regulators also want to know what changes were made once the breach was discovered.