In early September 2025, three very different cyber stories kept bringing me back to one question: how quickly can an organisation turn patchy evidence into a responsible decision?

PromptLock received a lot of attention and was an academic proof of concept, not ransomware loose in the wild. LunaLock's operators threatened to use stolen artwork, but they did not prove it. Jaguar Land Rover, by contrast, confirmed severe disruption to production and retail activity while saying little about the cause.

These distinctions matter, as shiny new vulnerabilities often get the attention. A prototype, an extortion claim and an operating stoppage do not justify the same response.

Taken together, they made me ask whether an organisation can classify what it sees, identify who can act, and make a reversible intervention while still not knowing all the facts.

With these thoughts in mind, let's see what happened.

PromptLock Was a Warning but not an Outbreak

On 27 August 2025, ESET described PromptLock as ransomware that used a locally accessible language model to generate Lua scripts and decide which files to search, copy or encrypt. Early variants had appeared on VirusTotal. ESET also called it a proof of concept; the destructive function in the code was inactive.

Reporting soon connected the prototype to academic research at New York University. That corrected a tempting but unsupported conclusion: there was no demonstrated campaign of PromptLock infections.

The important question, then, was not how many organisations had been hit. It was how security teams should handle a capability that was technically plausible but not operationally established. Dismissing it would lose an early signal. Treating it as an active outbreak would lose the evidence boundary.

The wider preparation problem was real. In May 2025, the UK's National Cyber Security Centre assessed that AI would almost certainly further shorten the interval between disclosure and exploitation of known vulnerabilities by 2027. That was a forward-looking judgement, not evidence about PromptLock. It did, however, make faster classification and patching a practical concern.

LunaLock Sold Fear where Proof Was Scarce

The LunaLock ransomware group reportedly targeted Artists&Clients, a commissioning platform, and threatened to submit stolen artwork to AI companies for model training if its ransom was not paid, according to vpnMentor's 5 September report.

The report established the threat. It did not establish that the attackers supplied the work to a model developer, that any developer would accept it, or that the material entered a training set. The uncertainty was part of the coercion.

That is a wicked incident-response problem. A victim may know that files were taken but lack reliable evidence about where they will go, how a recipient might retain them, or whether later removal is possible. An attacker can exploit the gap between a plausible feared outcome and a provable one.

The response starts with facts that should already be available: what left the environment, which data was affected, what contractual restrictions apply to legitimate processors and who has authority to contact platforms, insurers, law enforcement and affected creators. None guarantees a clean solution, but together they can reduce the amount of the story that the attacker gets to write.

JLR Showed the Cost of Interruption

On 2 September 2025, JLR said that it had proactively shut down systems after a cyber incident and was working to restart global applications in a controlled manner. It said retail and production activities had been severely disrupted and that, at that stage, it had no evidence customer data had been stolen.

A cyber incident had reached physical operations.

That statement confirmed that an important line had been crossed: a cyber incident had reached physical operations. It did not identify the attacker, establish a supply-chain route or connect the incident to AI.

For leaders, the immediate issue was continuity. JLR said it acted immediately and shut systems down proactively. Containment, however, can still shift costs to factories, dealers, suppliers, and customers, even when decision-making is prompt. The practical question is which reduced service can keep an essential outcome moving while a controlled restart is under way.

Final Perspective

These stories left me thinking: who is authorised to accept operational interruption while you still don't have all the facts? Security may advise on the risk, operations may understand the service, procurement may hold the contract, and a supplier may control the technical switch. If nobody carries the business decision, the organisation can be thoroughly documented and still unable to move. These situations highlight the importance of leadership and crisis planning, which develop leaders' muscle memory and practical experience in taking action during such times.

I'd choose one process whose interruption would quickly reach customers or production. The service owner should be able to show the signal that permits temporary action, the reduced service the business will accept and the conditions for a safe restart. JLR's statement is a useful reminder that prompt containment can be responsible and still carry serious operating costs. Someone has to be authorised to accept that cost before the incident forces the choice.