---
schema: 1
kind: research
title: "Kairos data-theft-only extortion — a US county paid ~$1M with no ransomware encryptor ever recovered"
headline: "Ransom-ISAC case study: a US county paid ~$1M to data-theft extortion actor Kairos — no encryptor was ever deployed"
summary: >
  Ransom-ISAC published a case study of "Kairos", a data-theft-only extortion actor that exfiltrated ~2 TB /
  ~1.6M files from a small US county government and was paid ~$1M in June 2025 without ever deploying a
  ransomware encryptor. Kairos claimed initial access via a brute-force credential attack; no locker binary
  has been obtained or confidently linked to the group, and Ransom-ISAC warns the actor's "proof of deletion"
  was not technically verifiable. The case is a reminder that pure-exfiltration extortion evades
  encryption-centric ransomware detection.
discovered_at: "2026-07-05T00:25:00Z"
event_date: "2025-05-19"
run_id: 2026-07-05T0009Z-intel
priority: notable
immediate_action: null
tags: [organized-crime, data-breach]
regions: [us]
sectors: [public-sector]
entities: [actor:kairos-extortion]
cves: []
sources:
  - url: "https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/"
    publisher: "Ransom-ISAC"
    date: "2026-07-03"
    role: primary
  - url: "https://securityaffairs.com/194750/security/u-s-government-agency-paid-1m-to-data-extortion-group-kairos.html"
    publisher: "Security Affairs"
    date: "2026-07-04"
    role: corroborating
  - url: "https://thehackernews.com/2026/07/us-government-entity-paid-kairos-group.html"
    publisher: "The Hacker News"
    date: "2026-07-04"
    role: corroborating
closed_sources: []
evidence:
  - quote: "We accessed your network using a bruteforce attack."
    publisher: "Kairos (quoted by Ransom-ISAC)"
  - quote: "No ransomware sample, encryptor, or locker binary has been obtained or confidently linked to Kairos"
    publisher: "Ransom-ISAC"
  - quote: "The provided 'proof of deletion' was not technically verifiable and should not be treated as evidence that the stolen data was destroyed"
    publisher: "Ransom-ISAC"
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - "Hunt for repeated authentication failures against shared / service accounts followed by a single success (T1110.001 / T1110.003) on externally reachable RDP, VPN, webmail and AD FS endpoints; enforce MFA on any exposed account that still lacks it."
  - "Tune extortion detection to large abnormal outbound transfers and unusual access to sensitive file shares — encryption-centric ransomware telemetry (mass file rename, entropy spikes) will not fire on data-theft-only extortion."
  - "Record in incident-response and legal negotiation playbooks that a threat actor's 'proof of deletion' is not technically verifiable — paid extortion must never be treated as guaranteed data destruction."
migrated_from: null
---

Ransom-ISAC has published a post-incident case study reconstructing a data-theft extortion case against a small US county government body, in which the victim paid roughly $1M after a May 2025 intrusion ([Ransom-ISAC, 2026-07-03](https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/); [The Hacker News, 2026-07-04](https://thehackernews.com/2026/07/us-government-entity-paid-kairos-group.html)). The distinguishing feature of the actor, self-styled "Kairos", is that it is a **pure data-theft-and-leak extortion** operation — Ransom-ISAC states "No ransomware sample, encryptor, or locker binary has been obtained or confidently linked to Kairos", so its leverage rested entirely on the threat to publish stolen data rather than on file encryption ([Ransom-ISAC, 2026-07-03](https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/)). Kairos itself claimed the intrusion was achieved through a brute-force credential attack — "We accessed your network using a bruteforce attack" — mapping to `T1110 Brute Force` and `T1078 Valid Accounts`; the report does not independently confirm the access method beyond the actor's own statement ([Ransom-ISAC, 2026-07-03](https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/)).

Kairos claimed access to more than 2 TB of data — approximately 1.6 million files — and exfiltrated it for leak-site leverage (`T1567 Exfiltration Over Web Service`); after roughly a month of negotiation the victim paid about $1M on 13 June 2025 ([Ransom-ISAC, 2026-07-03](https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/); [Security Affairs, 2026-07-04](https://securityaffairs.com/194750/security/u-s-government-agency-paid-1m-to-data-extortion-group-kairos.html)). Ransom-ISAC explicitly cautions that "The provided 'proof of deletion' was not technically verifiable and should not be treated as evidence that the stolen data was destroyed", noting there was nothing cryptographically binding the actor's deletion log to an actual deletion event ([Ransom-ISAC, 2026-07-03](https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/)).

**Defender takeaway:** An extortion model with no encryptor is invisible to detection tuned for ransomware's file-encryption signatures (mass rename, entropy spikes) — for a public-sector SOC the detectable signal is abnormal bulk outbound data movement and anomalous access to sensitive record stores (case-management, prosecutorial, HR file shares), not crypto activity. Pair that with brute-force / credential-abuse hunting on externally reachable authentication surfaces and hard MFA enforcement, since credential access remains the actor's claimed entry point. Finally, the "proof of deletion" caveat is a reusable negotiation-policy point: for any organization facing a similar demand, payment buys neither a guarantee of deletion nor verifiable proof of it.