Union County Clues Point To $1 Million Kairos Data-Extortion Payment

A leaked negotiation record points to a U.S. county government paying about $1 million after attackers stole files rather than encrypting its systems.

The case study by Rakesh Krishnan for Ransom-ISAC describes a data-extortion attack in which the threat was publication, with no public proof that the files were deleted.

Victim and exposure

The group called Kairos demanded payment after claiming it had taken more than 2 terabytes of data, including about 1.6 million files.

Krishnan found no sign of an encryptor, locker or demand for a decryption key.

Kairos appears to have relied on the stolen files themselves as leverage.

The case study does not name the victim, but its clues point to Union County, Ohio.

Files used as proof of theft included names such as Union.xlsx, “union co psi template.doc” and an archive called union.rar.

The attacker also highlighted a folder marked “prosecutors office,” warning that its release could help criminals avoid charges.

The victim described itself in the negotiation as a small county with limited resources.

Union County said in May 2025 that it had detected ransomware on its network.

It later notified 45,487 residents and staff that their data had been taken, affecting most of the county of roughly 70,000 people.

The exposed records included Social Security and financial details, fingerprints and passport numbers.

Neither Union County nor Kairos has confirmed that the case study describes the same incident.

If the connection is correct, the county paid about $1 million that it did not publicly disclose.

The Hacker News contacted the Union County Commissioners’ Office for comment.

Negotiation and payment

The negotiation lasted about a month.

Kairos opened with a $3 million demand.

The county began at $100,000, then increased its offer to $255,000 and $430,000.

Kairos reduced its demand to $2 million before setting a final price of $1 million and a Friday deadline, threatening to publish the files if the payment was not made.

The victim paid on June 13, 2025.

The transaction amounted to about 9.44 bitcoin, worth roughly $1 million at the time.

Krishnan traced the funds as they were split within hours and moved through a chain of wallets toward deposit addresses associated with Bybit, OKX and the Russian service BELQI.

That trail can give investigators leads, but it does not identify who controlled the wallets.

Kairos also sent a “proof of deletion” file.

A list of file names can show that an attacker possessed the data; it cannot establish that the original copies, or other copies, were erased.

What the payment could not prove

Union County called its incident ransomware, but nothing in the Kairos case study indicates that the attackers locked a machine.

The model instead matches data-theft extortion, in which stolen records become the pressure point.

Sophos reported in 2025 that only about half of ransomware attacks still involved encryption, the lowest rate in six years.

Silent Ransom Group, described as a Conti offshoot, has conducted similar data-theft extortion against U.S. law and finance firms without using an encryptor.

Leaked Black Basta chats from February 2025 showed another negotiation moving from a $1.5 million demand to a $100,000 counteroffer and then a $1 million payment.

Earlier Conti leaks in 2022 also helped researchers reconstruct these deals.

Kairos’ leak site is down, and its last known victim appeared in June 2026.

A wallet tied to the operation was still moving money as recently as May 2026, so the site’s disappearance does not establish that the group has stopped operating.

For small government networks, the practical controls remain basic: use multifactor authentication, monitor repeated failed logins and large outbound transfers, isolate legal, personnel and citizen records, and prepare a public statement plan.

Kairos claimed it entered by guessing a password.

Any promise to delete stolen data remains unverifiable when the only receipt comes from the attacker.