Data Theft Alone Forced a Seven-Figure County Payout
The break here is leverage, not encryption. Kairos did not need to lock machines to pressure the county; stolen prosecutor and county files were enough to create a payment crisis, because publication threats can hurt a local government fast.
Ransom-ISAC’s case study says the victim paid about $1 million after a month-long negotiation. The reported payload was stolen data, including prosecutor folder material, with no encryptor or decryption demand observed, and the county later notified 45,487 residents and staff that their data had been taken.
That shifts the threat model for public-sector teams that hold case files, HR records, financial data, or resident PII. Once the data is out, the fight is about disclosure, reputational damage, and pressure on the people named in the files, not just restoring systems.