LunaLock Ransomware threatens victims by feeding stolen data to AI models

LunaLock, a new ransomware gang, has introduced a distinctive cyber extortion tactic by threatening to turn stolen art into AI training data. The group, which targeted the artists’ platform Artists&Clients, stole digital art and demanded a $50,000 ransom, warning that if paid they would refrain from leaks; otherwise they would publish all data on a Tor site and submit the artwork to AI companies to be added to training datasets.

Their announcement says they have breached the website to steal and encrypt all data, and that users should urge the site’s owners to pay, or face public release of both data and source code, alongside personal data of users. The attackers claim they will supply the stolen artworks to AI models, effectively making the data permanent in training pipelines.

Experts note that LunaLock’s attack is unusual for a ransomware group, which typically targets sectors more likely to pay, and that, if confirmed, it could presage a new form of data inclusion in AI training datasets. OpenAI, Google and Anthropic are cited as examples of firms that scrape online art to train models, with Anthropic recently facing a major copyright settlement.