A U.S. authorities entity paid about $1 million to maintain stolen recordsdata from being leaked, based on a brand new case research by Rakesh Krishnan for Ransom-ISAC, constructed on a leaked negotiation chat and the blockchain path the cost left.
The odd half: the group that took the cash calls itself Kairos, nevertheless it will not be a ransomware gang in any respect. Krishnan discovered no signal that it ever locked a single machine: no encryptor, no locker, no demand for a decryption key. The menace was less complicated. Steal the recordsdata, then cost the sufferer to not publish them.
Krishnan doesn’t identify the sufferer, however the chat factors to Union County, Ohio. The proof-of-theft recordsdata carry names like Union.xlsx, 1 union co psi template.doc, and a last archive referred to as union.rar. The sufferer calls itself a small county with restricted sources. The attacker leans on one folder particularly, marked “prosecutors workplace,” warning that leaking it will assist criminals dodge expenses.
The clues match an actual case. In Might 2025, Union County, Ohio, stated it detected ransomware on its community and later notified 45,487 residents and employees that their information had been taken, affecting many of the county of roughly 70,000. The stolen information ran from Social Safety and monetary particulars to fingerprints and passport numbers.
Neither the county nor Kairos has confirmed the connection. But when it holds, a county authorities paid about $1 million it by no means publicly disclosed. The Hacker Information has contacted the Union County Commissioners’ Workplace for remark. This story can be up to date with any response.
The negotiation ran for a couple of month. Kairos opened at $3 million and claimed it was holding greater than 2 terabytes of knowledge, some 1.6 million recordsdata. The county began at $100,000, crept as much as $255,000, then $430,000. Kairos dropped to $2 million, then set a tough last quantity: $1 million, pay by Friday, or the recordsdata go public.
 |
| The cost on-chain: about 9.44 BTC lands within the Kairos-linked pockets. |
It used the standard levers: a countdown timer, tight deadlines, and threats to dump probably the most delicate folders first. The county paid on June 13, 2025, ten instances its first supply.
The cost was roughly 9.44 bitcoin, value about $1 million on the time. Krishnan traced the cash from there. Inside hours, it was break up in two and pushed via a series of wallets towards deposit addresses tied to the crypto exchanges Bybit, OKX, and a Russian service referred to as BELQI.
That sort of tracing arms investigators leads, not names. And the cash purchased nothing strong. Kairos despatched over a “proof of deletion” file, however an inventory of file names exhibits solely that the attacker as soon as had the recordsdata, not that the originals had been wiped. Paying to make stolen information disappear is an act of religion, and the receipt is written by the thief.
Union County referred to as what occurred to it ransomware, the phrase everybody reaches for, however within the Kairos case, nothing was locked. That’s the actual shift: a lot of what nonetheless will get referred to as ransomware now skips encryption and makes use of the stolen information itself because the stress level.
Sophos reported in 2025 that solely about half of ransomware assaults nonetheless contain any encryption, the bottom charge in six years. Some crews have dropped it fully. Silent Ransom Group, a Conti offshoot, has spent years operating pure data-theft extortion in opposition to U.S. regulation and finance corporations with no encryptor in any respect.
The Kairos chat matches a well-known negotiation sample, too. When Black Basta’s inside chats leaked in February 2025, an evaluation of the messages turned up a deal that ran from a $1.5 million demand to a $100,000 counter to a $1 million cost, virtually the identical arc. These chats, and the Conti leaks earlier than them in 2022, are how researchers now reconstruct the best way these bargains really get struck.
Kairos itself has gone quiet. The leak website is down, and its final identified sufferer confirmed up in June 2026. However a pockets tied to the operation was nonetheless shifting cash as lately as Might 2026, a reminder {that a} darkish leak website just isn’t the identical as a useless crew.
For anybody operating a small authorities community, the teachings are boring and acquainted, which is fairly the purpose. Activate multi-factor authentication, since Kairos claimed it bought in by merely guessing a password.
Look ahead to repeated failed logins, giant outbound information transfers, and burner file-sharing hyperlinks just like the temp.sh addresses Kairos used to maneuver the recordsdata. Hold authorized, HR, and citizen information walled off from the remainder of the community. Have a public assertion plan prepared earlier than you want one. And deal with any promise to delete stolen information as value precisely nothing.
