Ohio County Reportedly Paid $1 Million to Kairos Extortion Group
Summary
Ransom-ISAC reports that a U.S. government entity paid Kairos $1 million after a May 2025 intrusion. The entity reportedly appears to be Union County, Ohio; the county had notified 45,487 people that personal information was stolen.
Key points
- Ransom-ISAC reports that the government entity paid $1 million in Bitcoin on June 13, 2025, after three weeks of negotiations; the alleged payment is not independently confirmed in the article.
- A leaked negotiation transcript reportedly shows Kairos demanded $3 million. The entity raised its offer from $100,000 to $430,000 before accepting the reported $1 million settlement.
- Kairos claimed it accessed the victim's environment through a brute-force attack and stole more than 2 terabytes of data, or about 1.6 million files.
- Ransom-ISAC characterizes the incident as extortion without file-encrypting ransomware. It says the supplied listings are consistent with a file-server scrape, but deletion proof appeared selective and could not be independently verified.
- Ransom-ISAC did not name the entity; SecurityWeek reports it may be Union County, Ohio. The county reportedly notified 45,487 people that their personal information was stolen in a May 2025 attack.
- The reported notification covered sensitive information including Social Security and financial account details, medical and fingerprint information, and identification numbers.
Article Details
- Victim Organization
- Union County, Ohio (reported; not confirmed by the article)
- Victim Domain
- Unknown
- Incident Type
- Reported data-extortion attack following a brute-force intrusion; the anti-ransomware organization said it did not involve file-encrypting ransomware.
- Data Types Exposed
- Names
- Dates of birth
- Driver’s license and state ID numbers
- Passport numbers
- Social Security numbers
- Financial account details
- Fingerprint information
- Medical information
- Payment card details
- Affected Records
- 45,487 individuals were notified that their personal information was stolen.
- Affected Data Size
- Kairos claimed it stole over 2 terabytes of data, or approximately 1.6 million files; this claim was not independently confirmed.
- Operational Impact
- No operational disruption was reported. Ransom-ISAC characterized the incident as extortion without file-encrypting ransomware.
- Ransom Or Extortion
- Kairos reportedly demanded $3 million and eventually received a reported $1 million ransom payment in Bitcoin on June 13. The group threatened public disclosure of stolen information. Proof of deletion was provided, but Ransom-ISAC said it appeared selective and could not be independently verified.
- Claim Status
- claimed