US County Paid $1M Ransom to Cybercriminals, Files May Still Be For Sale
A US county paid $1 million to cybercriminals who claimed to have stolen 2TB of data, but received no proof of deletion. This raises concerns about the county's data being sold on the dark web and potential future extortion demands.
Key points
- A US county paid $1 million to Kairos, an extortion gang, in May and June 2025, after they claimed to have stolen over 2TB of data.
- The county never received independently verifiable proof that the stolen files had been deleted, only the gang's promise.
- The incident highlights the risks of paying cybercriminals, despite the feds' warnings against it.
- The county's data may still be for sale on the dark web, and the gang could demand another payment to not leak the data.
- The case study was published by Rakesh Krishnan on Ransom-ISAC, a global knowledge-sharing platform for defenders and incident responders.
US County Paid $1M Ransom to Cybercriminals, Files May Still Be For Sale
A recent case study by Rakesh Krishnan on Ransom-ISAC, a global knowledge-sharing platform for defenders and incident responders, revealed that a US county paid $1 million to cybercriminals who claimed to have stolen over 2TB of data.
The county, which remains unnamed, paid the ransom in May and June 2025 after the extortion gang, Kairos, demanded $3 million initially. However, the county never received independently verifiable proof that the stolen files had been deleted, only the gang's promise.
This incident highlights the risks of paying cybercriminals, despite the feds' warnings against it. The county's data may still be for sale on the dark web, and the gang could demand another payment to not leak the data.
The case study was based on a leaked transcript of the negotiations between the county and Kairos, as well as attacker-provided artifacts and screenshots, and payment-tracing evidence on the blockchain.
The incident serves as a reminder that paying cybercriminals may not always be the best solution, and that victims should consider other options, such as seeking help from law enforcement or cybersecurity experts.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.