Somewhere, a county commission had to sit in a room and decide whether to hand a million dollars of public money to criminals. Reporting indicates they decided yes.

According to SecurityWeek, a county government reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data. The alleged victim is believed to be a small Ohio county. We’ll flag the hedging in that sentence deliberately — the reporting describes the payment as reported rather than confirmed, and the victim as believed rather than established, so that’s exactly how we’re carrying it.

Why local government keeps ending up here

County governments are a near-perfect target, and not because anyone there is careless. They hold genuinely sensitive material — court records, law enforcement files, health and benefits data, property and tax records, employee files — which gives an extortionist real leverage. And they typically defend it with a security budget that a mid-sized private company would consider a rounding error, staffed by a handful of people who are also responsible for the printers.

That asymmetry is the whole business model. Extortion crews aren’t picking counties because they’re hard; they’re picking them because the data is valuable and the defenses are thin. A small county cannot hire a threat intelligence team. It can barely hire a second sysadmin.

What a million dollars actually buys

A promise. That’s it. Paying an extortion group to suppress stolen data purchases a criminal’s assurance that they will delete something you cannot verify they deleted, and will not sell something you cannot verify they haven’t already copied. There’s no receipt, no audit, no escrow. The data has been out of the county’s control since the moment it was taken, and no wire transfer reverses that.

We’ve watched this exact promise fail in public recently. In the Klue breach, the company told customers it had reached an agreement with the hackers not to publish stolen data — and as part of that deal, the attackers conceded that a second group also held a portion of the data, urging victims not to pay them. You can pay for silence and still find your data in someone else’s hands. That’s not a hypothetical risk; it’s a documented outcome.

And to be fair to whoever made this call: it is an appalling decision to face. When the alternative is your residents’ court records and health information posted publicly, “never pay” is easy advice to give from a distance and agonizing to follow from the chair.

What to do about it

• Decide before the incident: Establish a payment policy, legal review, and decision authority now — not at 2 a.m. with a countdown timer on a leak site.
• Treat payment as unreliable, not unthinkable: If you pay, plan as though the data will surface anyway. Notify, monitor, and support affected residents regardless.
• Fund the boring stuff: Tested offline backups, MFA everywhere, network segmentation, and patching are dramatically cheaper than $1 million. State cyber grant programs exist for exactly this — use them.
• Bring in law enforcement immediately: The FBI and state authorities add options, intelligence, and sometimes decryption assistance. They also feed the disruption operations that make this business harder.
• Minimize what you hold: Sensitive records that have aged out of their retention requirement can’t be stolen. Purge on schedule.

The outrage

A million dollars of public money — roads not paved, staff not hired, services not delivered — routed to an extortion group in exchange for a criminal’s word. That is the actual transaction here, and every dollar of it validates the model and funds the next attack, on the next county, which is also underfunded, and which will also face this decision.

The outrage doesn’t belong to the county IT staff who were almost certainly asking for resources long before this happened. It belongs to the structure that leaves local government custodians of the most sensitive records in a resident’s life while funding their defense like an afterthought. We have decided, collectively, that county governments should hold your court files and your health data on a shoestring — and then we act surprised when a criminal group prices that shoestring at seven figures. Fund the counties, or keep paying the ransoms. Those are the options, and one of them is cheaper.