A U.S. government entity paid a $1 million extortion demand in Bitcoin to the Kairos group following a data-theft attack against its network, according to reporting reconstructing the incident. The victim was Union County, Ohio, a small county government with limited security resources. Kairos deployed no ransomware encryptor at any point in the intrusion. The group stole files, claimed to hold over 2 terabytes of county data, and opened negotiations at $3 million. Union County countered at $100,000, moved to $430,000, and ultimately settled at $1 million, ten times its opening offer.
What Happened
Kairos gained access to Union County's network and exfiltrated sensitive files. There was no encryption stage, no ransom note dropped on locked endpoints, and no operational shutdown of county systems in the conventional ransomware sense. The entire leverage of the attack rested on a single threat: publish the stolen data.
The negotiation followed a pattern now well documented across leaked ransomware group chats. Kairos anchored high at $3 million with a volume claim of 2TB. Union County anchored low at $100,000. The gap closed over multiple rounds, with the county stepping up to $430,000 before the final $1 million agreement and Bitcoin payment.
That final number is worth sitting with. A small county government with a constrained budget paid seven figures to a group that never encrypted a single file. The payment was not for a decryptor. It was for a promise of deletion, which is unverifiable by definition.
What Was Taken
Kairos claimed to hold more than 2 terabytes of data from the county's network. Volume claims made by extortion groups during negotiation are marketing figures and should be treated as unverified ceilings rather than confirmed inventories. Groups routinely inflate them to justify the opening ask.
That said, county government networks hold a predictable and highly sensitive data profile: resident personally identifiable information, tax and property records, court and law enforcement files, health and human services case data, employee HR and payroll records, and vendor and contract documentation. A 2TB haul from a county network almost certainly touches several of these categories. For residents, this is data they had no choice about handing over.
The county's payment does not resolve the exposure. Once data leaves the network, deletion cannot be confirmed. Paying buys silence, not recovery.
Why It Matters
This case sits at the center of a structural shift in the extortion economy. Sophos data indicates only about half of ransomware attacks now involve encryption, the lowest rate in six years. Some crews, including the Silent Ransom Group, have dropped encryption entirely and operate as pure data-theft extortion outfits.
The economics explain the shift. Encryption is expensive for the attacker: it requires building and maintaining a reliable cryptor, it triggers loud EDR detections during mass file operations, it invites law enforcement attention proportional to the operational disruption caused, and it can be defeated outright by a victim with good backups. Data theft requires none of that. Exfiltration blends into normal network egress, backups provide zero protection against it, and the leverage is regulatory and reputational rather than operational.
For defenders, this rewrites the threat model. An organization can have flawless backups, tested restore procedures, and full recovery capability, and still be fully exposed. Recovery readiness is no longer a sufficient answer to extortion. The detection burden moves from "did something encrypt our files" to the much harder "did unusual volumes of data leave our network."
The public sector is disproportionately exposed here. Small county and municipal governments hold data of exactly the sensitivity that makes leak threats credible, while operating with security budgets and staffing that are a fraction of what comparable private-sector data custodians deploy. Kairos targeted the gap between data value and defensive capability, and that gap is widest in local government.
The Attack Technique
Reporting on this incident indicates Kairos claimed access was achieved through straightforward credential-based entry rather than exploitation of a novel vulnerability, with multi-factor authentication cited as the primary control that would have blocked it. The available account of the initial access vector is incomplete, and specifics beyond that should be treated as unconfirmed.
The broader tradecraft is consistent with the encryption-less extortion model: obtain valid credentials, authenticate to exposed remote access or cloud services, locate high-value file repositories, and stage bulk exfiltration. Without an encryption stage, the intrusion generates far fewer of the high-signal alerts that traditional ransomware produces, and dwell time is bounded only by how long the exfiltration takes.
Context on the negotiation side comes from the Black Basta chat leak in 2025 and the Conti leak in 2022, which gave researchers direct visibility into how these groups set anchors, apply deadline pressure, and read victim desperation. The Union County negotiation arc, high anchor, low counter, incremental convergence well above the victim's opening position, matches those documented playbooks closely.
What Organizations Should Do
Enforce phishing-resistant MFA everywhere, with no exceptions. Single-factor authentication on any externally reachable service is an open door. Prioritize VPN, remote desktop, email, and cloud administration consoles. Legacy and service accounts are the usual exception carve-outs, and they are exactly where attackers look.
Build egress monitoring and data loss detection. Backups do not defend against theft. Establish a baseline for normal outbound data volumes per host and per user, and alert on deviations. Watch for bulk transfers to cloud storage providers and file-sharing services, which are the standard exfiltration channels.
Inventory and classify sensitive data holdings. Extortion leverage is proportional to what an attacker can take. Most county networks hold years of accumulated records that no longer serve an operational purpose. Data that has been properly retired cannot be stolen.
Segment file repositories and enforce least privilege. A single compromised account should not be able to enumerate and read terabytes across every department. Restrict access by role and audit standing broad-access permissions.
Decide your extortion payment position before an incident, not during one. Union County negotiated from $100,000 to $1 million under active pressure. Establish policy, legal counsel, cyber insurance coordination, and law enforcement contacts in advance. Understand that payment purchases an unverifiable deletion promise, and plan breach notification obligations on the assumption that the data is exposed regardless.
Run tabletop exercises for a theft-only scenario. Most incident response plans are built around encryption and restoration. Exercise the case where nothing is encrypted, systems run normally, and the only artifact is a message demanding money for data already gone. The decision points and communications requirements are entirely different.
Sources: U.S. Government Pays $1 Million in Data-Theft Extortion: Inside the Kairos Case (2026)