The JLR cyber-attack was largely responsible for the slump in UK car production, the SMMT said, because other manufacturers reported stable figures for the month.
The attack is also estimated to cost £1.9bn and be the most economically damaging cyber event in UK history, according to research published on Tuesday.
The Cyber Monitoring Centre (CMC) found 5,000 businesses have been affected by the event and a full recovery will not occur until January 2026.
JLR said production across sites in Solihull, Wolverhampton and Halewood was returning in a phased approach.
The maker of the Jaguar I-Pace and Range Rover Sport is the second-largest car producer by volume in the UK after Nissan.
Overall, total vehicle production slumped by 35.9% in September compared to a year ago to about 54,300 vehicles.
The SMMT chief executive Mike Hawes said: “September’s performance comes as no surprise given the total loss of production at Britain’s biggest automotive employer following a cyber incident.
“While the situation has improved, the sector remains under immense pressure,” he added.
The majority of vehicles made in the UK are shipped overseas, and exports in September also slumped – down 24.5% – with the EU, US, Turkey, Japan and South Korea the top five destinations.
This year so far UK car and van factories have made 582,250 vehicles, which is 15.2% lower than at the same point in 2024.