U.S. paid Kairos $1 million in data-theft extortion case
infopulsetoday.com · post 95249 · 2026-07-04
WASHINGTON, July 4 — A U.S. government entity paid roughly $1 million to prevent stolen files from being leaked online, according to a new case study from Ransom-ISAC. The report, written by researcher Rakesh Krishnan, draws on a leaked negotiation chat and the blockchain trail left by the payment. The group that received the money calls itself Kairos.
But Krishnan found no evidence it ever locked a single machine. No encryptor.
No locker. No demand for a decryption key. The threat was simpler: steal the files, then charge the victim not to publish them.
Krishnan does not name the victim. But the chat points to Union County, Ohio.
Proof-of-theft files carry names like Union.xlsx and 1 union co psi template.doc, with a final archive called union.rar. The victim describes itself as a small county with limited resources. The attacker focused on one folder in particular, marked “prosecutors office,” warning that leaking it would help criminals dodge charges.
The clues fit a real case. In May 2025, Union County, Ohio, said it detected ransomware on its network. It later notified 45,487 residents and staff that their data had been taken, affecting most of the county of roughly 70,000.
Stolen records ran from Social Security and financial details to fingerprints and passport numbers. Neither the county nor Kairos has confirmed the connection.
But if it holds, a county government paid about $1 million it never publicly disclosed. The Hacker News has contacted the Union County Commissioners’ Office for comment. This story will be updated with any response.
The negotiation ran for about a month. Kairos opened at $3 million and claimed it was holding more than 2 terabytes of data, some 1.6 million files.
The county started at $100,000, crept up to $255,000, then $430,000. Kairos dropped to $2 million — and the source material cuts off there. What remains unclear is whether the county will now face questions about a payment it never acknowledged.
The case also raises a broader point: as data-theft extortion grows, victims may find themselves weighing public disclosure against the cost of silence.