[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fStXywku7UzkjFRNqooqRi72vG8ucpldOVenVkiMLL1g":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"7cceebf6-13d2-4e06-b376-26e88782b7fe","U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case","u-s-government-entity-paid-kairos-1-million-in-data-theft-extortion-case-05aacb","A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and the blockchain trail the payment left. The odd part: the group that took the money calls itself Kairos, but it may not be a ransomware gang at all. Krishnan found no sign that it ever locked a single","A U.S. government entity, likely Union County, Ohio, paid approximately $1 million in Bitcoin to a group known as Kairos to prevent the public release of stolen data. The group, which may not be a traditional ransomware gang as no encryption was involved, stole over 2 terabytes of sensitive information, including Social Security numbers and fingerprints. The payment was made after a month-long negotiation, and while Kairos provided a 'proof of deletion,' the article notes that paying for data deletion is an act of faith.","US government entity pays $1M to Kairos to prevent leak of stolen data.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fus-government-entity-paid-kairos-group.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiEfi15-eigOUF4SV157a0LsEW4uNvhRyEIhWWYVNo8tn0tfMjuJ0Cr6zYUDeVh6VfzA-7MpWgIVX8sJgieRMD6e0KSBmB2zNmTU1ko1KPMbkBd-JHMBluVBUOjV06SebkYq4AKFssmEQ6DdGw4yy4X3qesVYJcwwgZSsQFUu4Wfy3un9alrX2Qy8IjacE\u002Fs1600\u002Fcounty-hacked.jpg","2026-07-04T12:47:53+00:00","2026-07-04T14:00:09.814813+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Kairos","threat_actor",{"name":21,"type":22},"Bitcoin","product",{"name":24,"type":25},"Bybit","vendor",{"name":27,"type":25},"OKX",{"name":29,"type":19},"Silent Ransom Group",{"name":31,"type":19},"Conti","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56],{"type":57,"value":18,"context":58},"malware","Name of the threat actor group",[24,27,21],{"controls":61,"vendors":146},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":92,"name":93,"problem":94,"products":95},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":121,"name":122,"problem":123,"products":124},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[125,133,138],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":134,"product_name":135,"url":136,"description":137},"incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":162},"government-entity-pays-1m-after-2tb-data-theft-no-encryption-required","Government Entity Pays $1M After 2TB Data Theft — No Encryption Required","A U.S. government entity, likely Union County, Ohio, was extorted for approximately $1 million in Bitcoin after threat actors stole over 2 terabytes of sensitive data — including Social Security numbers and biometric fingerprint records — without deploying any ransomware encryption. This case highlights that data-theft-only extortion (also called 'pure exfiltration') is a growing and equally damaging attack vector that organizations often under-prepare for. The payment itself provided no guaranteed protection, as 'proof of deletion' cannot be independently verified and stolen data may have already been copied or shared. This incident underscores that the consequences of inadequate data protection extend far beyond operational downtime — they carry severe reputational, legal, and financial risks. Organizations must treat sensitive data exfiltration as a critical threat scenario equal to ransomware encryption.",[152,153,154,155,156,157,158,159,160,161],"CIS Control 3 — Data Protection","CIS Control 13 — Network Monitoring and Defense","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 SI-4 (System Monitoring)","NIST SP 800-53 SC-28 (Protection of Information at Rest)","NIST SP 800-61 — Computer Security Incident Handling Guide","GDPR Article 32 — Security of Processing","GDPR Article 33 — Notification of Personal Data Breach","NIST Privacy Framework: Protect-P (Data Management)","ITIL 4 — Information Security Management Practice",{}]