U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A U.S. government entity, likely Union County, Ohio, was extorted for approximately $1 million in Bitcoin after threat actors stole over 2 terabytes of sensitive data — including Social Security numbers and biometric fingerprint records — without deploying any ransomware encryption. This case highlights that data-theft-only extortion (also called 'pure exfiltration') is a growing and equally damaging attack vector that organizations often under-prepare for. The payment itself provided no guaranteed protection, as 'proof of deletion' cannot be independently verified and stolen data may have already been copied or shared. This incident underscores that the consequences of inadequate data protection extend far beyond operational downtime — they carry severe reputational, legal, and financial risks. Organizations must treat sensitive data exfiltration as a critical threat scenario equal to ransomware encryption.