A U.S. authorities entity paid about $1 million to maintain stolen recordsdata from being leaked, in response to a brand new case examine by Rakesh Krishnan for Ransom-ISAC, constructed on a leaked negotiation chat and the blockchain path the fee left.
The odd half: the group that took the cash calls itself Kairos, however it is probably not a ransomware gang in any respect. Krishnan discovered no signal that it ever locked a single machine: no encryptor, no locker, no demand for a decryption key. The risk was less complicated. Steal the recordsdata, then cost the sufferer to not publish them.
Krishnan doesn’t identify the sufferer, however the chat factors to Union County, Ohio. The proof-of-theft recordsdata carry names like Union.xlsx, 1 union co psi template.doc, and a closing archive referred to as union.rar. The sufferer calls itself a small county with restricted assets. The attacker leans on one folder particularly, marked “prosecutors workplace,” warning that leaking it might assist criminals dodge fees.
The clues match an actual case. In Could 2025, Union County, Ohio, mentioned it detected ransomware on its community and later notified 45,487 residents and employees that their knowledge had been taken, affecting many of the county of roughly 70,000. The stolen information ran from Social Safety and monetary particulars to fingerprints and passport numbers.
Neither the county nor Kairos has confirmed the connection. But when it holds, a county authorities paid about $1 million it by no means publicly disclosed. The Hacker Information has contacted the Union County Commissioners’ Workplace for remark. This story shall be up to date with any response.
The negotiation ran for a couple of month. Kairos opened at $3 million and claimed it was holding greater than 2 terabytes of information, some 1.6 million recordsdata. The county began at $100,000, crept as much as $255,000, then $430,000. Kairos dropped to $2 million, then set a tough closing quantity: $1 million, pay by Friday, or the recordsdata go public.
 |
| The fee on-chain: about 9.44 BTC lands within the Kairos-linked pockets. |
It used the same old levers: a countdown timer, tight deadlines, and threats to dump essentially the most delicate folders first. The county paid on June 13, 2025, ten occasions its first supply.
The fee was roughly 9.44 bitcoin, value about $1 million on the time. Krishnan traced the cash from there. Inside hours, it was break up in two and pushed via a series of wallets towards deposit addresses tied to the crypto exchanges Bybit, OKX, and a Russian service referred to as BELQI.
That sort of tracing arms investigators leads, not names. And the cash purchased nothing stable. Kairos despatched over a “proof of deletion” file, however a listing of file names exhibits solely that the attacker as soon as had the recordsdata, not that the originals had been wiped. Paying to make stolen knowledge disappear is an act of religion, and the receipt is written by the thief.
Union County referred to as what occurred to it ransomware, the phrase everybody reaches for, however within the Kairos case, nothing was locked. That’s the actual shift: a lot of what nonetheless will get referred to as ransomware now skips encryption and makes use of the stolen knowledge itself because the strain level.
Sophos reported in 2025 that solely about half of ransomware assaults nonetheless contain any encryption, the bottom price in six years. Some crews have dropped it totally. Silent Ransom Group, a Conti offshoot, has spent years operating pure data-theft extortion towards U.S. regulation and finance corporations with no encryptor in any respect.
The Kairos chat matches a well-known negotiation sample, too. When Black Basta’s inner chats leaked in February 2025, an evaluation of the messages turned up a deal that ran from a $1.5 million demand to a $100,000 counter to a $1 million fee, virtually the identical arc. These chats, and the Conti leaks earlier than them in 2022, are how researchers now reconstruct the way in which these bargains really get struck.
Kairos itself has gone quiet. The leak website is down, and its final recognized sufferer confirmed up in June 2026. However a pockets tied to the operation was nonetheless transferring cash as not too long ago as Could 2026, a reminder {that a} darkish leak website is just not the identical as a useless crew.
For anybody operating a small authorities community, the teachings are boring and acquainted, which is slightly the purpose. Activate multi-factor authentication, since Kairos claimed it bought in by merely guessing a password.
Look ahead to repeated failed logins, giant outbound knowledge transfers, and burner file-sharing hyperlinks just like the temp.sh addresses Kairos used to maneuver the recordsdata. Maintain authorized, HR, and citizen information walled off from the remainder of the community. Have a public assertion plan prepared earlier than you want one. And deal with any promise to delete stolen knowledge as value precisely nothing.
