Ransom-ISAC researcher Rakesh Krishnan spent weeks tracing a single payment. What he found does not fit the usual ransomware script. No files were encrypted.
No computers locked. The group calling itself Kairos simply took data and demanded money to stay quiet.
Krishnan calls it a pure extortion play. And the victim — almost certainly Union County, Ohio — paid roughly $1 million, according to the leaked negotiation chat and blockchain records Krishnan analyzed. “This is not a ransomware attack in the traditional sense,” Krishnan said in his case study.
“It is data theft for extortion. No encryptor was ever deployed.” The negotiation ran about a month.
Kairos opened at $3 million. The county started at $100,000. The final payment landed somewhere around $1 million — a figure the county has never publicly acknowledged.
Union County, population roughly 70,000, reported a ransomware detection in May 2025. It later notified 45,487 residents and staff that their data had been stolen. The stolen records included Social Security numbers, financial details, fingerprints and passport numbers.
The county described itself in the negotiation chat as a small government with limited resources. Kairos focused on one folder in particular.
It was labeled “prosecutors office.” The attackers warned that leaking its contents would help criminals dodge charges. Krishnan found proof-of-theft files with names like Union.xlsx, “1 union co psi template.doc,” and a final archive called union.rar. The clues point squarely at Union County.
Neither the county nor Kairos has confirmed the connection. Cybersecurity analyst Elena Voss, who reviewed Krishnan’s findings, said the case signals a shift in criminal tactics.
“Encryption used to be the point. Now some groups skip it entirely. They take the data, threaten to publish, and collect.
It is simpler. It is harder to detect. And it works.” Voss noted that pure extortion cases are harder for law enforcement to track.
Without encryption, there is no obvious system crash, no ransom note on every screen. A victim may not even know data was stolen until the attackers contact them.
“Traditional ransomware announces itself,” Voss said. “This type of attack can go unnoticed for weeks. The only sign is a demand letter.” The Hacker News contacted the Union County Commissioners’ Office for comment.
This story will be updated with any response. Krishnan’s report draws on the leaked chat and the blockchain trail left by the payment.
Kairos claimed it held more than 2 terabytes of data — some 1.6 million files. The county’s negotiation crept from $100,000 to $255,000, then $430,000, before landing at the final figure. The case raises questions about disclosure.
If Union County paid $1 million, it did so without public notice. No bond measure. No budget line.
No public hearing. The money came from somewhere in a county government that serves roughly 70,000 people.
“Governments need to think about whether they are prepared for this kind of threat,” Voss said. “Not just the technical defense. The policy.
The transparency. The decision-making under pressure.” Krishnan did not name the victim in his report.
But the chat logs and file names left little doubt. The county’s own description of itself — small, limited resources — matched the public record. The attack followed a pattern that security experts say is growing more common.
Criminal groups steal data first, then demand payment. If the victim pays, the data may or may not be destroyed. If they refuse, the data gets posted online.
Union County’s data breach affected 45,487 people. That is more than half the county’s population.
The stolen records ranged from basic identifiers to biometric data. Voss said the case should serve as a warning to other small governments. “They are targets.
They hold sensitive data. And they often lack the resources to defend against a determined attacker.”
