U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

Summary: A case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and blockchain records, describes a U.S. government entity paying about $1 million to a group calling itself Kairos to keep stolen files from being published, with no sign the group ever encrypted a machine. The chat points to Union County, Ohio, which disclosed in May 2025 that it had detected ransomware and notified 45,487 residents and staff of a data theft; the county paid roughly 9.44 bitcoin on June 13, 2025 after Kairos opened at $3 million and set a $1 million final deadline.
What you should know: Kairos sent a 'proof of deletion' file that shows only that it once held the files, not that the originals were wiped - so roughly $1 million bought an unverifiable promise from the party that stole the data. Sophos reported in 2025 that only about half of ransomware attacks still involve encryption, the lowest rate in six years, and Kairos claimed it got in by guessing a password.

Read the original at The Hacker News ↗