Report: County Government Paid $1 Million in Cyber Extortion Case

A U.S. local government entity reportedly paid $1 million to the Kairos cyber extortion group after attackers threatened to release stolen data from a breach tied to May 2025, according to Ransom-ISAC.

The anti-ransomware organization says a leaked negotiation log shows Kairos initially demanded $3 million in cryptocurrency. Over the course of roughly three weeks, the victim’s offers reportedly moved from $100,000 to $430,000 before the parties reached a $1 million settlement. The payment was allegedly made in Bitcoin on June 13.

Ransom-ISAC said the incident appears to have been an extortion campaign rather than a file-encrypting ransomware event. The group also reported that Kairos claimed to have taken more than 2 terabytes of data, or about 1.6 million files, after gaining access through a brute-force attack. According to the organization, the attackers used the threat of public disclosure and shared proof-of-access material to pressure the victim during negotiations.

What the leaked transcript suggests

Ransom-ISAC said the victim’s responses looked like those of an organization trying to buy time while legal, financial, leadership, and communications decisions were being coordinated. The group also noted that the attackers’ claimed proof of deletion was limited and could not be independently verified.

The organization did not publicly name the target, but the transcript reportedly describes it as a small county with limited resources. Based on public notices, the affected entity appears to be Union County, Ohio.

Potential impact on residents

In September, Union County informed 45,487 people that personal information had been exposed in a cyber incident linked to May 2025. The data involved reportedly included:

• Names, dates of birth, and identification numbers
• Driver’s license, state ID, and passport data
• Social Security numbers and financial account details
• Fingerprint, medical, and payment card information

SecurityWeek said it reached out to Union County for comment and will update its reporting if the county responds.