Union County, Ohio, population roughly 70,000, may have paid $1 million to data thieves who never actually locked a single computer. That is the picture emerging from a new case study by Ransom-ISAC, a group that tracks ransomware payments. Researcher Rakesh Krishnan pieced together the story from a leaked negotiation chat and the blockchain trail left by the payment.
The group that got the money calls itself Kairos. Krishnan found no evidence it deployed encryption software.
No locker. No demand for a decryption key. Just a threat: pay up or we publish your stolen files.
The victim in the chat describes itself as a small county with limited resources. The stolen files carry names like Union.xlsx and 1 union co psi template.doc.
A final archive is labeled union.rar. The attacker focused on one folder in particular, marked “prosecutors office,” and warned that leaking it would help criminals dodge charges. Those details line up with a real incident.
In May 2025, Union County said it detected ransomware on its network. It later notified 45,487 residents and staff that their data had been taken. Stolen records ranged from Social Security and financial details to fingerprints and passport numbers.
Neither the county nor Kairos has confirmed the connection. If it holds, a county government paid roughly $1 million it never publicly disclosed.
That raises questions for residents whose data was exposed. The county has not said whether it paid a ransom. The Hacker News reached out to the Union County Commissioners’ Office for comment.
No response has been reported. The negotiation ran about a month.
Kairos opened at $3 million and claimed it was holding more than 2 terabytes of data, some 1.6 million files. The county started at $100,000, crept up to $255,000, then $430,000. Kairos dropped its demand in stages.
The final payment landed near $1 million. Krishnan tracked the cryptocurrency transaction on the blockchain. The money moved to wallets controlled by Kairos.
No decryptor was ever needed. There was nothing to unlock.
This is a pure data-theft extortion play. No encryption. No locked machines.
Just stolen files and a threat to publish. That model is becoming more common.
Attackers skip the encryption step because it is noisy and draws attention. They grab data, demand payment, and if the victim refuses, they dump the files online. It is cheaper and faster for the criminals.
For the victim, the calculus is the same: pay or face exposure of sensitive records. Union County’s population is roughly 70,000. The 45,487 people notified represent a majority of residents.
That includes county employees and anyone who interacted with county services. Social Security numbers, financial account details, fingerprints, passport numbers — all taken.
The attacker specifically targeted the prosecutors office folder. The chat shows the extortionist warned that leaking that data would let criminals avoid prosecution. That is a direct threat to public safety.
Krishnan’s report does not name the victim. But the evidence points squarely at Union County.
The file names. The population size. The May 2025 ransomware announcement.
The county has not confirmed the payment. It has not denied it either. Silence is not an answer.
Residents deserve to know whether their tax dollars went to the people who stole their data. The case study is a window into a growing problem.
Ransomware is evolving. Encryption is optional. The threat is now simpler: we have your files, pay us or we release them.
Union County, if the connection holds, paid the price. The question is whether that payment bought safety or simply funded the next attack.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Ohio County Possibly Paid Ransom Without Data Being Encrypted”, “description”: “Union County, Ohio, population roughly 70,000, may have paid $1 million to data thieves who never actually locked a single computer. That is the picture…”, “datePublished”: “2026-07-04T15:21:00+00:00T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Isabella Moore”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}}
