A June 2025 cyberattack disrupted Taos County government systems and public-facing services. County officials later acknowledged a cyberattack, while Kairos claimed responsibility and data theft. Full restoration and the extortion outcome remain unverified.
Threats to publish or sell stolen data without evidence of encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Business, financial, customer, administrative, or operational transactions could not be completed normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
Taos County experienced a cyberattack that disrupted government computer systems beginning in early June 2025. Our reporting dates detection to June 5 and recounts County Manager Brent Jaramillo’s July 1 acknowledgment of a sophisticated cyberattack. Local real-estate agent Rob Swan’s June 26 account places detection approximately June 6 and describes a precautionary shutdown.
The disruption affected administrative and records functions. Our report identified unavailable computers in several county offices and the Adult Detention Center, alongside slower court work and stalled property transfers. These consequences support a public-service disruption assessment; they do not establish that detention custody, emergency response or every county service ceased.
The June 26 account independently described county departments operating with limited capability or stopping work and identified real-estate transactions as affected. July 4 reporting described partial recovery with continuing manual work and delays. A system shutdown can impede services without proving that an attacker encrypted files.
Confidence is high that a disruptive cyberattack occurred, based on the reported county acknowledgment and consistent accounts of service interruption. The technical mechanism remains less certain. Although our original headline used ransomware, the reviewed evidence does not establish an encryptor, encryption extent or a specific initial-access method.
Comparitech reported a Kairos listing and payment deadline, but explicitly could not authenticate the purported stolen files. Responsibility remains a claim. Neither the claimed data volume nor the group’s geographic origin is treated as an independently established fact in this record.
The exact intrusion window, systems affected, verified data-loss scope, payment outcome and full-restoration date remain unresolved. A local writer inferred payment from removal of a listing; that inference does not verify a transaction.
Operational disruption is presumed resolved because of the elapsed time. No end date is assigned.
Kairos claims responsibility for data theft from Taos County. External listing discovery is June19; Comparitech reported a purported sample and payment deadline June20. County verification of the claim, volume, file authenticity and payment was not established.
Geographic remit of the affected county government; disruption documented for specific systems and services.
Affected county operations based in Taos.
Our report recounts the county acknowledgment and continuing administrative, court and property-transfer disruption.
Local account describes precautionary shutdown, limited county service capability and affected real-estate transactions.
External lead identifies taoscounty.org as a Kairos victim.
Researcher reports a Kairos listing, purported file sample and deadline, with no county verification or authentication of files.
Signed-in members can report an error, update, or missing source.
