Nobody locked a single computer in Union County, Ohio. Even so, a new case study says the county handed roughly $1 million in Bitcoin to a group called Kairos in June 2025, after the group stole its data and threatened to leak it.
The attackers took more than 2 terabytes of files. Among them were Social Security numbers and passport details belonging to nearly 45,500 residents. Kairos never deployed ransomware to encrypt the county’s systems. It simply held the stolen data over the county’s head.
How the haggling went
The study reconstructed the negotiation from leaked chats. Kairos started at $3 million and settled at $1 million, paid as about 9.44 Bitcoin. Before the deal closed, the group sent a “proof of deletion” file. It was a weak offering, since all it confirmed was that the attackers had once had access to the data.
The payment then moved through a chain of wallets to exchanges including Bybit, OKX and a Russian service. That sort of tracing gives investigators leads, not definitive identities.
A growing way to extort
Only about half of ransomware attacks now involve locking systems, the report said, and research from 2025 shows groups such as the Silent Ransom Group using the same data-only approach. Initial access in the Union County case reportedly came from a guessed password.
Experts recommend multi-factor authentication and monitoring for unusual data transfers.
