In May 2025, a small Ohio county government suffered a brute-force intrusion by the Kairos cyber extortion group, resulting in the theft of over 2 terabytes of data comprising about 1.6 million files. The stolen data included sensitive personal information such as names, dates of birth, government ID numbers, Social Security numbers, financial account details, fingerprint and medical information, and payment card details. The attackers demanded a $3 million ransom in cryptocurrency to prevent public disclosure, but after a three-week negotiation, the victim paid $1 million in Bitcoin on June 13, 2026. The attack was an extortion incident without ransomware encryption. The attackers provided selective proof of deletion, but no independent verification was possible. The county notified affected individuals in September 2025. The incident highlights risks from brute-force attacks leading to large-scale data theft and extortion demands.

The breach exposed highly sensitive personal and financial information of approximately 45,487 individuals, including government-issued ID numbers, Social Security numbers, medical and fingerprint data, and payment card details. The public release of such data could lead to identity theft, financial fraud, and privacy violations. The victim organization incurred a significant financial loss by paying a $1 million ransom. The incident also likely caused reputational damage and operational disruption to the county government. No ransomware encryption was involved, but the extortion threat leveraged stolen data exposure.

Patch status is not applicable as this is an incident report of a cyber extortion attack rather than a software vulnerability. The victim paid the ransom to prevent data release. Organizations should ensure strong authentication controls to prevent brute-force attacks, implement robust monitoring for unauthorized access, and have incident response plans for extortion scenarios. Since the attackers provided no independent proof of data deletion, affected individuals should be notified and advised to monitor for potential misuse of their information. No official fix or patch is relevant for this incident.