A cyber attack on a big customer reaches its suppliers through late payments, paused orders and weaker finances. How it happens and what to check.
In September 2025, Jaguar Land Rover's production lines stood silent after a cyber attack. Its suppliers' own systems were working perfectly. Their order books were not, and the money they were owed now depended on a customer that could not run its own business.
Most businesses think about cyber risk as a question about their own systems. Is our data backed up? Are our staff trained? Do we have cover if we are hit?
Those are the right questions. The mistake is stopping there. There is a second kind of cyber risk that rarely makes the risk register. It arrives when someone else is attacked, or impersonated, and it reaches you through your sales ledger. You can have perfect security and still take the loss.
A cyber attack does not usually show up on your ledger as a bad debt on day one. It shows up in three slower ways.
First, payments stop moving. If a customer's finance or ordering systems are offline, invoices are not approved and payment runs are not made. The customer may have every intention of paying. It simply cannot, until the systems are rebuilt. For a supplier with payroll to meet, a month of silence from its biggest customer is a cash flow problem whether or not the money eventually arrives.
Second, orders stop. A manufacturer that cannot run its lines does not need your parts. A retailer that cannot take online orders does not need your stock. Lost orders are not a bad debt, but they hit the same cash flow at the same time as the slow payments.
Third, the customer itself is weakened. A serious attack costs money to recover from, loses sales and can strain a company's borrowing. Most recover. Some come out with less headroom than they went in with, and that is the customer you are now extending credit to.
The JLR attack remains the clearest example. Production stopped for weeks. A year on, it is still described as the costliest cyber attack in UK history, with an estimated economic impact on the UK of around $2.5bn. Much of that damage landed not on JLR but on the thousands of businesses in its supply chain that relied on it for revenue.
The Co-op's half-year results, published in September 2026, give a rare view of what an attack does to a company's own finances. The Group estimates that its 2025 attack cost it £206m of revenue and £80m of profit. Its banks agreed to amend the covenant tests on its borrowing for 2025 and the first half of 2026 to reflect the attack. The Co-op says trading has since returned to pre-attack levels. That is the good outcome. It still needed its lenders' patience to get there.
This autumn the pattern has continued in retail. In early October ASOS confirmed that customer names and contact details had been exposed, and its shares fell by more than 10%. A week later TFG London, owner of Hobbs, Whistles and Phase Eight, disclosed an attack that took several IT systems offline and delayed some online orders.
Neither looks like a repeat of 2025. But the frequency matters. Hiscox's latest Cyber Readiness Report, published in September 2026, found that nearly one in three businesses had suffered a successful attack in the past year, with an average of around 32 hours of disruption. And 44% named supply chain or third-party disruption as one of their top risks.
There is good research on how this works. A study published in the Journal of Financial Economics in 2023 followed the NotPetya attack of 2017, one of the most damaging cyber attacks on record, through companies' supply chains.
The authors found that the hit to profits was amplified roughly four times as it moved from the companies attacked to their customers. The customers worst affected were those with few alternative suppliers. Those that coped did so by drawing on cash and bank credit lines, and many then changed suppliers for good.
The same logic works in the other direction. A supplier that depends on one or two large customers has nowhere else to sell when those customers stop ordering and paying. Concentration is what turns somebody else's incident into your crisis.
Most attacks do not end in insolvency. Some contribute to one.
We have read the administrators' reports for 433 recent UK administrations. In at least two, the administrators named a cyber attack in 2025 among the causes of failure. One was a logistics business with around £6.5m of turnover, where the attack caused significant disruption and cost on top of rising fuel prices and arrears to HMRC. Its unsecured creditors were owed £2.4m and are not expected to receive anything. The other, a small services firm, lost around a third of its remaining revenue after a ransomware attack.
Behind each of them is a list of suppliers who were never attacked, and who now sit in the queue of unsecured creditors. We explain what that queue usually receives in what happens when a customer goes into administration.
Not every cyber loss starts with a customer's systems going down. Some start with a convincing email.
One of our clients, a commodity trader, received an order that appeared to come from an existing customer. The details looked right, and the goods were delivered as instructed to a third-party warehouse. The real customer had never placed the order. Our client lost £650,000 of product.
Another client, a manufacturer, was asked to pay what looked like a supplier's invoice. It paid £120,000. The supplier did not exist.
Neither loss is a bad debt. The customer you approved never owed the money, so trade credit insurance does not respond. These are fraud losses, which fall to crime cover or to the social engineering section that some cyber policies include, often with a much lower limit than the main policy. Check what yours says.
Two habits cost nothing. Confirm any new delivery address or change of bank details by phone, on a number you already hold. And treat an unusual, urgent order from a familiar customer as a reason to call before you ship.
You cannot control a customer's security. You can control how exposed you are to it.
Usually that is right. Large customers rarely fail because of one attack. But "they'll pay eventually" and "they'll pay on time" are different promises, and your payroll runs on the second one. If the Co-op needed patience from its banks, its suppliers needed patience from theirs.
That is the other answer, and it covers a different risk. Cyber insurance protects your own business: your systems, your data, and your own losses if you are attacked. It is not designed to pay you when a customer's systems fail and its invoices go unpaid.
That second risk belongs with trade credit insurance. The insurer sets a credit limit on each customer and monitors it while you trade. If a customer becomes insolvent, or a delay drags on past the waiting period in the policy, the debt is treated as a loss and the policy typically pays most of it. Our plain-English guide explains how that works.
Cyber risk does not stop at your own firewall. It travels through your customers, it grows as it travels, and it lands hardest on the suppliers who depend on them most. Know which customers you could not afford to wait a month for, keep watching them after an incident, and put the right cover behind the right risk. Your security protects your systems. Only your credit decisions protect your ledger.
If you would like a quick view of a customer you depend on, our free Buyer Assessment tool is a good place to start. If you would rather talk through how exposed your ledger is, get in touch or read more about credit insurance.
