The county paid on June 13, 2025. It had started the negotiation offering $100,000. The final payment, roughly 9.44 bitcoin and worth about $1 million at the time, was ten times that.
The details come from a case study by researcher Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and a trace of the blockchain trail the payment left. The group on the other end calls itself Kairos. Krishnan found no sign that it ever locked a machine: no encryptor, no locker, no demand for a decryption key. It stole files and charged the victim not to publish them. The report says no ransomware sample has been confidently tied to the group.
A county, though the report does not say so
Ransom-ISAC does not name the victim, citing privacy concerns. The chat does the job itself. Sample files requested during the talks were called Union.xlsx and “1 union co psi template.doc”, and the archive handed over after payment was union.rar. The victim described itself as “a small county with limited resources.”
That points to Union County, Ohio. In May 2025 the county said it had detected ransomware on its network on May 18. Its notification letter said intruders were inside from May 6 to May 18 and took some county data. It later told 45,487 residents and employees that their information had been stolen, most of a county of about 70,000 people. The records included Social Security numbers, financial details, fingerprints and passport numbers.
Neither the county nor Kairos has confirmed the link. If it holds, a county government paid about $1 million without saying so publicly. The Hacker News said it had contacted the Union County Commissioners’ Office for comment.
Twenty-eight days of haggling
Kairos listed the county on its leak site on May 21, 2025. It claimed to hold more than 2 terabytes of data, 1,602,775 files, and said it got in by brute-forcing a password.
Kairos opened at $3 million. The county came back at $100,000 on June 4, then moved to $255,000 and $430,000. Kairos dropped to $2 million, then set a final number: $1 million by Friday or the files go public. The report describes the usual pressure: a countdown timer, tightening deadlines, threats to release the most sensitive folders first. One folder, marked “prosecutors office,” got special attention. Kairos warned that leaking it would help criminals avoid prosecution and cause a public outcry.
The county’s replies read, in the report’s words, like an organization “buying time while legal, leadership, financial, and communications decisions were coordinated.”
Proof of deletion
After payment Kairos sent a 238 MB text file listing file names as proof of deletion. It proves the attacker once held the files and nothing more. The report says the list was “not technically verifiable and should not be treated as evidence that the stolen data was destroyed.”
Krishnan followed the bitcoin from there. Within hours it split in two, 6.61 BTC to one wallet and 2.83 BTC to another. The larger share moved toward a Bybit deposit address three days later. The smaller one passed through a string of intermediate wallets before reaching addresses linked to OKX and a Russian exchange called BELQI. The active transfers on June 16 took three hours and 34 minutes. Ransom-ISAC calls the four wallet addresses it flagged investigative leads and not attribution; exchange records and subpoenas are what turn a trace into names.
A crew gone quiet
Kairos first appeared in November 2024 and has listed 88 victims. Its leak site is down. A likely backend server in Ukraine was found displaying a seizure notice attributed to the country’s Security Service, yet a wallet tied to the operation was still moving funds as recently as May 2026.
Sophos reported in 2025 that only about half of ransomware attacks still involve encryption, the lowest share in six years. Ransom-ISAC’s advice to public bodies is plain: set escalation paths in advance, line up negotiation support, watch for large outbound data transfers, and assume an attacker’s deletion claim cannot be checked.
Sources
- U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
- U.S. Government Agency Paid $1M to Data Extortion Group Kairos
