Jaguar Land Rover has extended its UK production halt to September 24 as investigations continue into the cyberattack that forced the company to shut down systems earlier this month. The attack, first disclosed on September 2, has now disrupted manufacturing at JLR’s Solihull, Halewood, and Wolverhampton plants for over three weeks.

The company said in a statement, “We have taken this decision as our forensic investigation of the cyber incident continues, and as we consider the different stages of the controlled restart of our global operations, which will take time.” JLR has since confirmed that hackers accessed internal data, though the scope of the breach — whether it includes customer or supplier information — remains unclear.

A group claiming affiliation with Scattered Spider, Lapsus$, and ShinyHunters has taken credit for the intrusion. According to Sophos researchers, the same collective has been linked to a recent surge in social engineering attacks targeting major retailers and enterprises across the UK and US. On the attacker’s decision to go dark, Halcyon’s Cynthia Kaiser noted, “Announcing — loudly — that your group is going quiet strikes us more as a ham-handed attempt to reduce law enforcement scrutiny.”

The UK’s National Cyber Security Centre is assisting JLR, and government officials are reportedly in talks with the company to resolve the disruption. Meanwhile, 33,000 workers have been told to stay home, and Unite the union is urging the government to introduce a furlough plan. “We’re already seeing employers having discussions on potential redundancies,” said Unite’s Jason Richards. “People have to pay rent, they have to pay mortgages and if they’re not getting any pay, what are they supposed to do?”

The shutdown is believed to be costing JLR over £50 million per week in lost output, and the BBC reports that some suppliers face possible bankruptcy without intervention. While JLR dismissed speculation that downtime could last into November, it acknowledged that returning to full production will take time — even after the lines restart.