The victim never said a word in public, but a leaked chat did. Researcher Rakesh Krishnan of Ransom-ISAC followed that chat and the blockchain trail behind it, and concluded that a U.S. government entity paid about $1 million to a group calling itself Kairos so that stolen files would stay private.
No encryptor turned up, no locker, no demand for a decryption key. Just files and a price.
Krishnan’s case study does not name the victim. File names in the proof-of-theft samples, among them Union.xlsx, “1 union co psi template.doc” and an archive called union.rar, point to Union County, Ohio. Neither the county nor Kairos has confirmed it. The Hacker News said it had asked the county for comment.
The timing fits. In May 2025 Union County detected ransomware on its network. It later told 45,487 people that their data had been taken, including Social Security numbers, financial account details, fingerprints and passport numbers.
Kairos claimed more than 2 terabytes across roughly 1.6 million files, and leaned hardest on one folder marked “prosecutors office”. Publishing it, the attacker warned, would help criminals beat their charges.
A month of haggling
The talks ran about a month. Kairos opened at $3 million. The county answered with $100,000 and crept up to $430,000, while Kairos came down to $2 million before setting a final deadline at $1 million. The payment, about 9.44 bitcoin, went out on 13 June 2025, ten times the county’s first offer.
Within hours the coins were reportedly split and passed through a chain of wallets toward deposits at Bybit, OKX and BELQI, a Russian service.
What did the money buy? A “proof of deletion” file. Ransom-ISAC called that evidence “selective, not comprehensive”, and noted it could have come from wiping a single copy of the data. A county of roughly 70,000 residents, if it is the payer, never disclosed the payment, even though it publicly described the breach as ransomware.
Kairos claimed it got in by guessing a password. Sophos reported in 2025 that only about half of ransomware attacks involved encryption, down from 70% a year earlier.
Kairos itself has gone dark. Its leak site is offline and its last known victim was posted in June 2026, according to the case study. A linked wallet was still moving funds in May.
Sources
- US government body paid $1M in data-theft extortion
- Union County, Ohio: Kairos Data-Theft Extortion — Wasteland
