Union County Ohio Paid $1 Million Bitcoin Ransom to Kairos After May 2025 2TB Exfil

The incident began with a May 2025 brute-force compromise of the county's environment. Kairos exfiltrated approximately 1.6 million files without deploying encryption ransomware. A leaked negotiation transcript shows the group initially demanded $3 million in cryptocurrency before settling on $1 million after the county raised its offer from $100,000 to $430,000 under deadline pressure. Ransom-ISAC documented selective proof-of-deletion artifacts that could not be independently verified.

Procurement and incident records reveal the county's limited IT resources and absence of multi-factor authentication on exposed services. The payment directly shifts costs to local taxpayers while normalizing extortion settlements by under-resourced governments. Similar patterns appear in prior unreported incidents involving small municipalities where leadership prioritized containment over disclosure or technical remediation.

Independent analysis of the transcript indicates the victim coordinated legal financial and communications responses during the three-week window. Official notifications to affected individuals omitted the ransom payment details. No technical attribution evidence links Kairos to state actors.

Local governments should expect continued targeting via credential stuffing. Procurement databases show rising contracts for basic access controls yet implementation lags persist across Ohio counties.