Ransomware is the wrong word for what hit a U.S. government entity earlier this year. No files got locked. No screens went black.
No demand for a decryption key ever arrived. Instead, the attacker took a simpler route: steal the data, then charge the victim not to publish it.
That distinction matters, and it points to a shift in how cybercriminals operate. A case study published Friday by Ransom-ISAC, written by researcher Rakesh Krishnan, documents the incident in detail. The group behind it calls itself Kairos.
The victim paid roughly $1 million. Krishnan found no evidence Kairos ever deployed an encryptor on a single machine.
The attack was pure extortion. Steal first. Threaten second.
Collect third. Krishnan drew on a leaked negotiation chat and the blockchain record of the payment. He does not name the victim.
But the evidence points hard at Union County, Ohio. Proof-of-theft files carried names like Union.xlsx and 1 union co psi template.doc.
A final archive was called union.rar. The victim described itself as a small county with limited resources. The attacker focused on one folder in particular, marked “prosecutors office,” warning that leaking it would help criminals dodge charges.
Union County, Ohio, said in May 2025 that it detected ransomware on its network. It later notified 45,487 residents and staff that their data had been stolen.
That is most of the county of roughly 70,000 people. Stolen records included Social Security numbers, financial details, fingerprints, and passport numbers. Neither the county nor Kairos has confirmed the connection.
But if it holds, a county government paid about $1 million it never publicly disclosed. The negotiation ran for about a month. Kairos opened at $3 million and claimed it was holding more than 2 terabytes of data — some 1.6 million files.
The county started at $100,000, crept up to $255,000, then $430,000. Kairos dropped to $2 million, then $1.5 million.
They settled somewhere around $1 million. This is not a ransomware story. It is a data-theft story.
The distinction is critical for every organization that thinks backups are enough. Backups do not stop a leak.
Backups do not keep stolen Social Security numbers off the dark web. Pure extortion attacks like this one sidestep the entire encryption game. They skip the technical headache of deploying a locker across a network.
They go straight for the leverage: your data, your reputation, your liability. Union County is a small government. Limited budget.
Limited IT staff. The kind of target that cannot afford a six-figure ransom, let alone a seven-figure one.
Yet it paid. That tells you something about the pressure these attacks generate. A county of 70,000 people, facing the leak of prosecutor office files, paid a million dollars to keep them quiet.
The case study from Ransom-ISAC is blunt about what happened. No encryptor.
No locker. No demand for a decryption key. Just a threat and a payment.
The blockchain trail shows the money moved. The chat logs show the negotiation. The files show the theft.
Ransomware has dominated headlines for years. But the model is changing.
Attackers are learning that encryption is optional. The threat of exposure is often enough. And when the victim is a government entity holding sensitive records on tens of thousands of residents, that threat carries real weight.
Union County notified 45,487 people that their data was taken. That is a lot of letters.
A lot of credit monitoring offers. A lot of residents wondering if their fingerprints or passport numbers are now for sale. The county never confirmed it paid.
The case study says it did. Krishnan’s report is a window into a growing problem. The old ransomware playbook is being rewritten.
The new one may not require a single line of malicious code. Just a stolen file and a threat to publish it.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Kairos paid $1 million after data theft, not ransomware attack”, “description”: “Ransomware is the wrong word for what hit a U.S. government entity earlier this year. No files got locked. No screens went black. No demand…”, “datePublished”: “2026-07-04T15:21:00+00:00T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Noah King”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}}
