U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A U.S. government entity reportedly paid about $1 million in Bitcoin to the Kairos group after attackers allegedly stole more than 2 TB of data and threatened to publish it. A Ransom-ISAC case study said the incident showed no confirmed signs of file encryption, a ransomware locker, or any decryption demand, indicating a pure data-theft extortion operation rather than a traditional ransomware attack. Negotiations reportedly lasted about a month, with Kairos reducing its demand from $3 million to a final payment of roughly 9.44 BTC.

The victim was not formally identified, but chat logs and file-name clues cited in the reporting align with Union County, Ohio, which disclosed a 2025 breach affecting 45,487 residents and staff, though neither the county nor Kairos confirmed the connection. Blockchain tracing found the payment was quickly split and routed toward deposit addresses linked to Bybit, OKX, and BELQI, offering investigative leads but not definitive attribution. The case underscores the rise of encryption-less extortion, where organizations face pressure to pay despite having no technical way to verify that stolen data was actually deleted.