Unconfirmed Report Links Kairos to $1 Million Union County Extortion Payment
Summary
A Ransom-ISAC case study uses leaked negotiations and blockchain tracing to link a roughly $1 million Kairos extortion payment to Union County, Ohio. Neither the county nor Kairos confirmed the connection; the alleged extortion involved data theft without encryption.
Key points
- A case study by Rakesh Krishnan for Ransom-ISAC says leaked negotiations and blockchain tracing point to Kairos extorting Union County, Ohio; neither party confirmed the connection.
- Union County previously reported detecting ransomware and notified 45,487 residents and staff that their data had been taken; the link to Kairos and the alleged payment are unconfirmed.
- The leaked negotiation reportedly shows Kairos opening with a $3 million demand and settling for about $1 million, or 9.44 BTC, paid on June 13, 2025.
- The case study traces the funds through wallets toward deposit addresses associated with Bybit, OKX, and BELQI; it notes that tracing offers investigative leads, not identities.
- The account describes no evidence that Kairos encrypted files. A purported proof-of-deletion file containing filenames does not establish that the stolen originals were erased.
- Kairos reportedly claimed it gained access by guessing a password. Suggested defenses include multifactor authentication, monitoring failed logins and large outbound transfers, and segmenting sensitive records.
Article Details
- Victim Organization
- Union County, Ohio (possible victim; connection to the Kairos case is unconfirmed)
- Incident Type
- Alleged data-theft extortion without file encryption
- Data Types Exposed
- Social Security numbers
- Financial data
- Fingerprints
- Passport numbers
- Affected Records
- 45,487 residents and staff were notified that their data had been taken; the exact number of affected records is not stated.
- Affected Data Size
- Kairos claimed to hold more than 2 terabytes across approximately 1.6 million files; this claim is unverified.
- Operational Impact
- Union County reported detecting ransomware on its network in May 2025. The article says no file encryption was identified in the alleged Kairos extortion case.
- Ransom Or Extortion
- A leaked negotiation and blockchain tracing reportedly indicate a payment of approximately 9.44 BTC, worth about $1 million, on June 13, 2025, to prevent publication of stolen files. The reported connection to Union County is unconfirmed.
- Claim Status
- alleged
MITRE ATT&CK
People
Threat Actors
Black BastaThe article references leaked internal chats that reportedly revealed a negotiation and payment comparable to the Kairos case.ContiThe article references Conti leaks as a source researchers use to reconstruct extortion negotiations.KairosThe group reportedly demanded payment to prevent publication of stolen files. Its alleged connection to Union County is unconfirmed, and the article reports no evidence of file encryption in this case.Silent Ransom GroupThe article describes it as conducting data-theft extortion against U.S. law and finance firms without using an encryptor.