A U.S. government entity paid approximately $1 million to prevent the public release of stolen files, according to a detailed case study published by Ransom-ISAC that reconstructs the attack through leaked negotiation chats and blockchain payment records. The group behind the demand, operating under the name Kairos, presents a stark and growing anomaly in the cyber extortion landscape: it never encrypted a single file, nor did it deploy a ransomware locker. The threat was conceptually simpler and, in this instance, proved deeply effective\u2014steal the data, then monetize the victim\u2019s fear of exposure.<\/p>\n
The analysis by researcher Rakesh Krishnan uncovered no evidence that Kairos used any form of file encryption. There was no encryptor, no demand for a decryption key, and no locked system. The entire pressure campaign rested on the possession and threatened publication of sensitive data. The victim, which the evidence strongly suggests is Union County, Ohio, found itself negotiating not to regain access to its own files, but simply to keep them private. This represents a clear evolution in the cyber extortion playbook, moving away from the technical complexity of encryption toward a leaner, more coercive model.<\/p>\n
Krishnan\u2019s case study does not name the victim, but the digital evidence paints a highly specific picture. The proof-of-theft files shared by Kairos carried names such as Union.xlsx<\/strong>, 1 union co psi template.doc<\/strong>, and a final archive titled union.rar<\/strong>. The victim described itself to the attacker as a small county with limited resources. The threat actor focused heavily on a folder marked \u201cprosecutors office,\u201d warning that its release would directly aid criminals in evading charges.<\/p>\n These details align with a real-world incident. In May 2025, Union County, Ohio, publicly reported detecting ransomware on its network. The county later notified 45,487 residents and staff\u2014covering most of the county\u2019s approximate population of 70,000\u2014that their personal data had been compromised. The stolen data included Social Security numbers, financial account details, fingerprints, and passport information. Neither the county nor the Kairos group has officially confirmed the connection, but the confluence of evidence is significant. If accurate, it would mean a county government paid a $1 million ransom without any corresponding public disclosure at the time of payment.<\/p>\n The extortion negotiation stretched over roughly one month. Kairos opened the demand at $3 million, claiming possession of over 2 terabytes of data comprising some 1.6 million files. The county\u2019s initial counteroffer was $100,000. The bargaining then moved through $255,000 and $430,000 as Kairos dropped its demand to $2 million. The group eventually set a hard deadline: $1 million, payment by Friday, or the files would be published.<\/p>\n The county paid on June 13, 2025. The final amount was ten times its first offer. The attacker employed standard pressure tactics: a visible countdown timer, strict deadlines, and threats to release the most sensitive folders first. Krishnan traced the payment, roughly 9.44 bitcoin worth about $1 million at the time. Within hours, the funds were split and moved through a chain of wallet addresses toward deposit addresses on the cryptocurrency exchanges Bybit, OKX, and a Russian service called BELQI. This kind of blockchain tracing provides investigators with leads, but not identities.<\/p>\n Kairos sent a \u201cproof of deletion\u201d file after receiving payment. However, as the case study highlights, a list of file names only proves that the attacker once possessed the data, not that the original copies were securely erased. Paying a ransom to make stolen data disappear is an act of faith, and the only receipt comes from the thief. There is no technical mechanism to verify that a copy does not remain cached, backed up, or otherwise retained by the extortionist. This fundamental asymmetry is why security professionals consistently advise against paying demands for data deletion.<\/p>\n Union County described the incident as ransomware, the term most commonly used for such attacks. Yet the Kairos case involved no encryption. This distinction is critical and reflects a measurable trend across the cyber extortion industry. Sophos reported in 2025 that only about half of all ransomware attacks still involved any form of encryption, the lowest rate observed in six years. Some groups have abandoned encryption entirely. The Silent Ransom Group<\/a>, an offshoot of the Conti gang, has operated for years as a pure data-theft extortion crew targeting U.S. legal and financial firms, with no encryptor deployed at any stage.<\/p>\n The negotiation arc seen in the Kairos chat also mirrors a pattern observed in high-profile leaks. When Black Basta\u2019s internal chat logs were leaked in February 2025, analysis revealed a deal that followed a nearly identical trajectory: a $1.5 million demand, a $100,000 counter, and a final $1 million payment. The Conti leaks from 2022 similarly exposed the mechanics of ransomware bargaining. These internal chat leaks have become a primary research tool for analysts reconstructing how these deals are actually struck under pressure.<\/p>\n Kairos itself has fallen silent. Its leak site is offline, and its last publicly known victim was listed in June 2026<\/a>. However, a wallet linked to the operation was still moving funds as recently as May 2026<\/a>. A dark leak site may go dark, but the same does not always hold for the crew that ran it.<\/p>\n The defenses against this style of attack are well understood, but the Kairos case underscores their importance with fresh urgency. Kairos claimed its initial access was gained by simply guessing a password. The lessons are concrete and actionable. Multi-factor authentication must be enabled on every externally facing system. Network monitoring should flag repeated failed login attempts, large outbound data transfers, and the use of ephemeral file-sharing services like temp.sh, which the attacker used to exfiltrate files. Legal, HR, and citizen records must be segmented and walled off from broader network access. A public communication plan for a data incident should be prepared before an incident occurs, not drafted in a crisis. And every promise of data deletion must be treated, operationally, as worth nothing.<\/p>\n Anyone whose data may have been compromised in a county or local government breach should take immediate protective steps. Enable multi-factor authentication on all online accounts, especially those related to financial services, healthcare, and government portals. Place a fraud alert or credit freeze with the three major credit bureaus\u2014Equifax, Experian, and TransUnion\u2014to block unauthorized account openings. Monitor bank statements, credit card transactions, and credit reports for unusual activity. Use a reputable, paid virtual private network (VPN) with a verified no-logs policy and AES-256 encryption when accessing public Wi-Fi networks to prevent credential interception. Change passwords for all accounts where the same or similar credentials were reused, and use a zero-knowledge password manager to generate and store unique, complex passwords moving forward. These steps do not undo a breach, but they substantially reduce the risk of secondary fraud and identity theft.<\/p>\n","protected":false},"excerpt":{"rendered":" A U.S. government entity paid approximately $1 million to prevent the public release of stolen files, according to a detailed case study published by Ransom-ISAC that reconstructs the attack through leaked negotiation chats and blockchain payment records. The group behind the demand, operating under the name Kairos, presents a stark and growing anomaly in the […]<\/p>\n","protected":false},"author":7,"featured_media":84804,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/62058.png","fifu_image_alt":"U.S. Government Paid $1 Million to Kairos in Data Extortion Case","footnotes":""},"categories":[349],"tags":[],"class_list":["post-62058","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/62058.png","fifu_image_alt":"U.S. Government Paid $1 Million to Kairos in Data Extortion Case","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/62058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=62058"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/62058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/84804"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=62058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=62058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=62058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Negotiation Breakdown: From $3 Million to a $1 Million Final Demand<\/h2>\n
The Futility of Paying for Data Deletion<\/h2>\n
Ransomware Without Encryption: A Growing Industry Shift<\/h2>\n
Lessons for Small Government Networks: Hardening Against Pure Extortion<\/h2>\n
What Affected Users Should Do Now<\/h2>\n