A US county paid $1 million to the extortion group Kairos after a data breach that compromised more than 2 TB of files. The group promised deletion of the data but provided no independent verification that the files had been removed.
The incident occurred in May and June 2025, according to a leaked negotiation transcript analyzed by researcher Rakesh Krishnan on the Ransom-ISAC platform. The victim was described only as a US county, initially receiving a $3 million demand. Negotiations progressed from an initial $100,000 offer to $255,000, then $430,000, before settling at $1 million.
The stolen data included names, Social Security numbers, driver’s license numbers, financial account information, dates of birth, fingerprint records, medical information, payment card details and passport numbers. The city of Dublin, Ohio lies within the county, and Union County had previously reported a May 2025 ransomware incident involving similar personal information.
The FBI and the Cybersecurity and Infrastructure Agency advise that paying ransoms does not guarantee data recovery and may encourage further attacks. While no federal ban on ransom payments exists, North Carolina and Florida have enacted statutes prohibiting public agencies from paying extortion demands. Experts argue that addressing widespread digital insecurity, rather than imposing blanket payment bans, is necessary to reduce ransomware incidents.
The case highlights the challenge of independently verifying data deletion claims and continues to fuel debate over the effectiveness of ransom payments as a response to cyber extortion.

