Exfiltrated Resident Data Pushes County to Pay Seven Figures
The break here is leverage, not encryption. A small county can be priced into a seven-figure payment when attackers hold stolen resident records and control the deadline on public release.
Ransom-ISAC says the group took more than 2 terabytes of data in a May 2025 brute-force intrusion and settled for $1 million after a three-week negotiation, with payment made in Bitcoin on June 13. The county later notified 45,487 people that names, Social Security numbers, driver’s license and passport data, financial account details, medical information, and other sensitive records were stolen.
That is the lasting risk: once identity and financial records are exfiltrated, the damage extends beyond service disruption into disclosure pressure, public-notice burden, and long-tail identity abuse.