Anne Arundel County, Maryland, a Baltimore suburb, has confirmed that an unauthorized actor got into part of its computer network in late August and copied certain files from the systems it reached. The confirmation came after the Rhysida ransomware gang claimed the attack. The group claimed it holds 2.6 TB of county documents and threatened to leak them unless it is paid $2 million.
The county has not confirmed any of the group's claims. Its official incident page says a cybercriminal group has claimed on the dark web to have county data, and that the county will not confirm or comment publicly on that claimed data while it reviews the files. The county says it is still reviewing the copied files to work out what they contain and whether any of them relate to individuals.
What the county has confirmed
According to the county's Cyber Incident page, on Aug. 28, 2026, the county detected "irregular activity on a limited subset of systems within the county computer network." The county says it moved to secure its network and to assess the scope and source of the activity. According to The Record, a county spokesperson said staff found the irregular activity on Aug. 28 and investigated a limited set of systems. The spokesperson also said an unauthorized actor accessed a limited number of systems and copied certain files from them.
The county says the August activity did not interfere with county operations, and it does not expect any impact on essential services. The Record reported that the county notified federal law enforcement and other government agencies. The county has not said what kinds of data were in the copied files.
Those are the confirmed facts: someone got into county systems without authorization, and files were copied. The county has not described the August incident as ransomware, and it has not said whether any systems were encrypted. Its statement that operations were not disrupted fits an incident built mainly around stealing data and threatening to publish it, but the county has not described the intruder's methods.
What Rhysida claims
Everything in this section comes from the group, not from the county. Rhysida claimed responsibility for the intrusion. The group claimed it holds 2.6 TB of documents taken from the county and threatened to publish them unless it receives a $2 million ransom. The Record reported that the claim was posted on X by Comparitech.
None of these figures has been verified. Ransomware groups have reasons to exaggerate how much data they hold, because a bigger number puts more pressure on the victim to pay. A data volume posted on a leak site says little about what the files contain or how sensitive they are.
Rhysida has targeted government bodies before. The Record listed several of the group's earlier targets: Berlin's government, which the group recently tried to extort; Kuwait's Finance Ministry; the City of Seattle; Columbus, Ohio; and Maryland's own transportation department. If the claim against Anne Arundel County holds up, the county would join that department as a second Maryland government target.
A separate incident from 2025
The timing has caused some confusion. The county is dealing with two incidents at once, and it has worked to keep them apart. A county spokesperson told The Record that the Aug. 28 attack is a "separate incident" from an earlier one.
The county's incident page says it learned of suspicious activity on Feb. 22, 2025. Investigators found unauthorized access to a limited part of the network between Jan. 28 and Feb. 22, 2025, and certain files were accessed or downloaded during that period. The FAQ on the incident page says the event "has since been identified as a ransomware attack that originated from an external threat actor." The Record reported that a different group carried out last year's attack, which forced the county to shut off multiple systems.
The notification letters described on the county page are for the 2025 incident. The county says it finished a third-party review of those files and will begin sending letters to potentially affected individuals the week of Oct. 19, 2026. The notices concern people who received treatment or related services through the county Department of Health. Depending on the person, the information involved may include names, Social Security numbers and medical details. The county says it has no indication that the information has been used for identity theft or fraud.
Residents who receive a letter now should read it as a notice about the 2025 ransomware attack. The county has not announced any notifications for the August 2026 intrusion and says its file review is still underway.
Timeline
- Jan. 28 – Feb. 22, 2025: Unauthorized access to part of the county network during the first incident. The county learns of it on Feb. 22 and later identifies it as a ransomware attack by an external threat actor.
- Aug. 28, 2026: The county detects irregular activity on a limited subset of systems and starts containment and scoping. It notifies federal law enforcement.
- After August 2026: Rhysida claims the attack. The group claimed it holds 2.6 TB and demanded $2 million.
- Oct. 16, 2026: The Record reports the county's confirmation that files were copied.
- Week of Oct. 19, 2026: Notification letters for the 2025 incident begin going out.
Why local governments keep showing up on leak sites
The county spokesperson pointed to a broader pattern, citing "a surge in these kinds of calculated cybercrimes" targeting state and local governments. The Record noted that cities and counties in New Mexico, Utah, Texas, Nebraska, Missouri and Arizona have all had service outages from cyberattacks in the past two weeks. County governments hold a wide range of records about residents and employees. A county that is still sending notifications for one incident while responding to another is a clear example of how long recovery from these events takes.
Anne Arundel County's statements so far suggest a contained intrusion. The county describes a limited subset of systems, no operational disruption, and no expected effect on essential services. That does not settle the main question for residents and employees, which is what was in the copied files. The county says its review will answer that.
What It Means for Defenders
The county has not published technical details about how the intruder got in. It has not released indicators of compromise or named any exploited vulnerability, so no specific patch can be tied to this incident. The lessons for other public-sector IT teams are about general readiness:
- Plan for theft without encryption. In this case, files were copied and operations kept running. Monitoring that only watches for encryption or outages can miss this kind of incident. Watch for unusual outbound data volumes, especially from file servers and document repositories, and alert on large transfers to destinations you don't recognize.
- Segment sensitive data stores. The county reports that only a "limited subset" of systems was affected, which shows the value of containment. Keep systems that hold resident personal data, such as health records, apart from general office networks, and restrict access to the accounts that need it.
- Treat a second incident as a real possibility. If your organization has already recovered from an attack, check that any credentials, remote access paths and service accounts that might have been exposed were rotated or removed. Confirm that the fixes from the first incident's root-cause review were completed and verified.
- Harden remote access and identity. Require phishing-resistant multi-factor authentication on VPNs, remote desktop gateways, email and administrative accounts. Review dormant and third-party accounts.
- Prepare for leak-site claims. Decide ahead of time who reviews a claim, how legal and communications teams respond, and when law enforcement is notified. Anne Arundel County notified federal law enforcement and declined to comment on the claimed data while it reviews the files. Agencies can borrow that approach.
- Use government resources. CISA's StopRansomware hub offers a Ransomware Readiness Self-Assessment, guidance on keeping offline, encrypted and regularly tested backups, and #StopRansomware advisories on specific groups. It directs victims to report to federal law enforcement through IC3 or a Secret Service field office.
For residents of Anne Arundel County, the county's incident page is the official source, and the county runs a toll-free line at 877-274-8983. Read any letters carefully to see which incident they concern. Be wary of unsolicited emails or calls that mention the breach and ask for personal or financial information.
