{"id":737099,"date":"2026-07-05T02:55:16","date_gmt":"2026-07-04T23:55:16","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/us-government-body-paid-1m-in-data-theft-extortion\/"},"modified":"2026-07-05T02:55:16","modified_gmt":"2026-07-04T23:55:16","slug":"us-government-body-paid-1m-in-data-theft-extortion","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/us-government-body-paid-1m-in-data-theft-extortion\/","title":{"rendered":"US government body paid $1M in data-theft extortion"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af2ac89384d6\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af2ac89384d6\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/us-government-body-paid-1m-in-data-theft-extortion\/#TLDR\" >TL;DR<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/us-government-body-paid-1m-in-data-theft-extortion\/#Anatomy_of_a_1m_deal\" >Anatomy of a $1m deal<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/us-government-body-paid-1m-in-data-theft-extortion\/#Ransomware_without_the_ransomware\" >Ransomware without the ransomware<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/us-government-body-paid-1m-in-data-theft-extortion\/#Unglamorous_lessons\" >Unglamorous lessons<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/06\/fbi-russian-hackers-signal-backup-recovery-key-unc5792.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p><em><\/p>\n<div class=\"postContent-tldr\">\n<h4 class=\"postContent-offsetTitle\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>A US government entity paid about $1m to the Kairos extortion group to keep stolen files private, according to a Ransom-ISAC case study based on a leaked negotiation chat and blockchain analysis. The clues point to Union County, Ohio, though neither party has confirmed it. The case illustrates how much of today\u2019s \u201cransomware\u201d involves no encryption at all.<\/p>\n<\/div>\n<p><\/em><\/p>\n<p>A US government entity paid around $1m to stop stolen files from being published,\u00a0<a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/thehackernews.com\/2026\/07\/us-government-entity-paid-kairos-group.html\" target=\"_blank\" rel=\"nofollow noopener\">according to a case study<\/a>\u00a0by researcher Rakesh Krishnan for Ransom-ISAC. The analysis draws on a leaked negotiation chat and the blockchain trail the payment left behind.<\/p>\n<p>The group behind the deal calls itself Kairos, but it may not be a ransomware gang in any traditional sense. Krishnan reportedly found no encryptor, no locker, and no demand for a decryption key, just stolen files and a price for keeping them private.<\/p>\n<p>The case study does not name the victim, but file names in the proof-of-theft samples, including an archive called union.rar, point to Union County, Ohio. Neither the county nor Kairos has confirmed the connection, and The Hacker <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> says it has contacted the county for comment.<\/p>\n<p>The clues do line up with a real incident. In May 2025, Union County detected ransomware on its network and later\u00a0<a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/therecord.media\/ohio-ransomware-attack-impacts-45000\" target=\"_blank\" rel=\"nofollow noopener\">notified 45,487 people<\/a>\u00a0that data including <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">Social<\/a> Security numbers, fingerprints, and passport details had been taken.<\/p>\n<p>If the identification holds, a county of roughly 70,000 residents made a $1m payment it never publicly disclosed. The attacker reportedly leaned hardest on a folder marked \u201cprosecutors office\u201d, warning that a leak would help criminals evade charges.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Anatomy_of_a_1m_deal\"><\/span>Anatomy of a $1m deal<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The negotiation ran for about a month, according to the case study. Kairos opened at $3m and claimed to hold more than 2TB of data across some 1.6 million files.<\/p>\n<p>The county reportedly countered at $100,000 and inched up to $430,000, while Kairos dropped to $2m before fixing a final $1m deadline. The victim paid on 13 June 2025, ten times its opening offer.<\/p>\n<p>The payment of roughly 9.44 bitcoin matched about $1m at that week\u2019s market prices. Within hours it was reportedly split and routed through a chain of wallets towards deposits at Bybit, OKX, and BELQI, a Russian service that recalls\u00a0earlier ransomware laundering through WEX and BTC-e.<\/p>\n<p>Tracing of this kind gives\u00a0investigators leads rather than identities. Criminal crews have spent years\u00a0refining how they wash cryptocurrency\u00a0through mules, mixers, and loosely regulated exchanges.<\/p>\n<p>What the money bought is another question. Kairos handed over a \u201cproof of deletion\u201d file, but a list of file names only proves the attacker once held the data, and\u00a0promises to delete stolen data have unravelled before.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Ransomware_without_the_ransomware\"><\/span>Ransomware without the ransomware<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Union County described the incident as ransomware, yet nothing in the Kairos case was ever encrypted. A growing share of what still carries that label now skips lockers entirely and uses the stolen data itself as the pressure point, a playbook that\u00a0recent extortion-only breaches\u00a0have aimed at the private sector too.<\/p>\n<p><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.sophos.com\/en-us\/blog\/the-state-of-ransomware-2025\" target=\"_blank\" rel=\"nofollow noopener\">Sophos reported in 2025<\/a>\u00a0that only around half of ransomware attacks involved encryption, down from 70% a year earlier and the lowest rate in six years. Silent Ransom Group, an offshoot of the Conti ecosystem, has spent years running\u00a0<a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/fbi-warns-of-luna-moth-extortion-attacks-targeting-law-firms\/\" target=\"_blank\" rel=\"nofollow noopener\">encryption-free extortion against US law firms<\/a>, drawing repeated FBI warnings.<\/p>\n<p>The bargaining arc is familiar too. When Black Basta\u2019s internal chats\u00a0<a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/techcrunch.com\/2025\/02\/21\/a-huge-trove-of-leaked-black-basta-chat-logs-expose-the-ransomware-gangs-key-members-and-victims\/\" target=\"_blank\" rel=\"nofollow noopener\">leaked in February 2025<\/a>, one deal moved from a $1.5m demand to a $100,000 counter and a $1m payment, almost the same curve.<\/p>\n<p>Kairos itself has gone quiet, with its leak site offline and its last known victim posted in June 2026, per the case study. A linked wallet was reportedly still moving funds in May, so a dark leak site should not be read as a retired crew.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Unglamorous_lessons\"><\/span>Unglamorous lessons<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>For small government networks, the takeaways are deliberately dull. Kairos claimed it got in by guessing a password, so multi-factor authentication and alerts on repeated failed logins would have raised the cost of entry considerably.<\/p>\n<p>Defenders should also watch outbound transfers and throwaway file-sharing links, such as the temp.sh addresses the attacker used, and keep legal and citizen records segmented from the wider network. Above all, a thief\u2019s receipt for deleted data is worth exactly what it cost to type.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/kairos-data-extortion-million-payment\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR A US government entity paid about $1m to the Kairos extortion group to keep stolen files private, according to a Ransom-ISAC case study based on a leaked negotiation chat and blockchain analysis. The clues point to Union County, Ohio, though neither party has confirmed it. The case illustrates how much of today\u2019s \u201cransomware\u201d involves&#8230;<\/p>\n","protected":false},"author":1,"featured_media":737100,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/media.thenextweb.com\/2026\/06\/fbi-russian-hackers-signal-backup-recovery-key-unc5792.avif","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-737099","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/737099","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=737099"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/737099\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/737100"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=737099"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=737099"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=737099"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}