ANNE ARUNDEL COUNTY CONFIRMS GOVERNMENT DATA THEFT FOLLOWING AUGUST CYBERATTACK AS RANSOMWARE GROUP CLAIMS 2.6 TERABYTES STOLEN

ANNAPOLIS, MARYLAND — Anne Arundel County officials have confirmed that cybercriminals gained unauthorized access to government computer systems and stole files during an August 2026 security incident, raising concerns about the potential exposure of sensitive information maintained by the Maryland county.

The county formally disclosed the findings on October 15, 2026, following an investigation into suspicious network activity discovered on August 28. The announcement comes as the Rhysida ransomware group has claimed responsibility for the intrusion, reportedly demanding $2 million and threatening to publish approximately 2.6 terabytes of information allegedly taken from county systems.

Although county officials have confirmed unauthorized access and file theft, they have not verified Rhysida’s claims concerning the volume of stolen information or publicly attributed the intrusion to the group.

The incident affected a limited number of systems within Anne Arundel County’s government network. According to the county’s official statement, cybersecurity personnel identified irregular activity and initiated immediate measures to secure the affected infrastructure, investigate the intrusion, and determine the extent of unauthorized access.

Third-party cybersecurity specialists were brought in to conduct a comprehensive digital forensic examination. Investigators subsequently determined that an unauthorized actor had accessed certain systems and copied files without authorization.

County officials are reviewing the stolen material to establish what information was involved, whether it contains records relating to identifiable individuals, and whether formal notification requirements apply.

The investigation has not yet established the number of affected residents or the specific categories of information removed from the network.

Anne Arundel County, which includes Maryland’s capital city of Annapolis and communities surrounding the Baltimore metropolitan area, serves more than 600,000 residents. Its government maintains administrative systems supporting public services, records management, licensing, financial operations, and numerous county departments.

The county also contains major federal government facilities and installations, including Fort George G. Meade, home to several national security organizations. The presence of federal facilities within the county does not establish that those organizations’ systems were affected by the intrusion.

The confirmed breach concerns Anne Arundel County government infrastructure, and authorities have not identified any compromise of nearby federal agency networks.

County officials reported that the August incident did not interfere with government operations and that they anticipate no disruption to essential services as a result of the intrusion.

This operational continuity is significant because unauthorized data access and file theft can occur without interrupting public-facing systems. An organization may continue delivering services while investigators work to determine whether information was copied from internal networks.

The county has also notified federal law enforcement and other government partners, coordinating its response while the forensic investigation continues.

Rhysida’s reported extortion demand introduces a separate concern involving the potential publication of stolen government information. Cybercriminal organizations sometimes use threats of disclosure to pressure victims into paying, even when the affected organization has maintained operational continuity.

Rhysida is a known ransomware operation documented in joint federal cybersecurity advisories issued by the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and Multi-State Information Sharing and Analysis Center.

Federal cybersecurity authorities have previously described Rhysida affiliates as targeting organizations across multiple sectors, including government, education, healthcare, and other institutions. The group’s documented operations have involved unauthorized network access, data theft, and ransomware deployment.

In its April 30, 2025, update to a joint advisory concerning Rhysida, federal authorities outlined methods associated with the group’s broader activities, including compromised credentials, exploitation of vulnerable systems, lateral movement through networks, and attempts to access sensitive information.

Those findings describe Rhysida’s known criminal operations generally. They do not establish which intrusion method was used against Anne Arundel County or whether ransomware encryption occurred during the August attack.

The county has not publicly disclosed the technical entry point, compromised software, duration of unauthorized access, or specific methods used to remove the files.

Authorities also reported no indication, as of October 15, that information taken during the incident had been used to commit consumer fraud or identity theft.

The county’s confirmation arrives during an ongoing recovery and notification process associated with a separate cybersecurity incident from 2025.

During that earlier incident, unauthorized access occurred between January 28 and February 22, 2025. Investigators determined that files had been accessed or downloaded from a limited portion of the county’s network, prompting an extensive review of potentially compromised personal information.

The earlier breach involved data associated with the county government and Department of Health. Potentially affected records included names, addresses, Social Security numbers, financial account information, identification documents, medical information, insurance details, and other sensitive personal records, depending on the individual.

County officials completed their review of the 2025 incident and announced that notification letters would begin being distributed to identified individuals during the week of October 19, 2026.

Those notifications concern the 2025 breach, not the August 2026 intrusion. The two investigations remain separate, and the county has reported no indication that the latest incident was connected to the earlier attack.

This separation is important because the disclosure of sensitive information in the 2025 case does not establish that the same categories of records were stolen during the newer intrusion.

The repeated targeting of the county also raises broader concerns about the cybersecurity responsibilities of local governments. County networks can contain substantial amounts of personal, financial, administrative, and operational information, making them attractive targets for criminals seeking data that may support extortion or identity theft.

Strong authentication, network segmentation, vulnerability management, continuous monitoring, and tested incident-response procedures are important safeguards against unauthorized access. Maintaining those protections across aging government infrastructure can present substantial operational and financial challenges.

Anne Arundel County stated that it would notify individuals if the ongoing review establishes that their personal information was affected by the August intrusion. Officials have committed to providing additional information as the investigation produces confirmed findings.

For residents concerned about the separate 2025 incident, the county recommends monitoring financial accounts, credit reports, and insurance statements for suspicious activity, along with reporting potential misuse to the relevant institutions.

The August 2026 investigation remains active. Unauthorized access and file theft are confirmed, but the quantity and contents of the stolen material, the identity of the attackers, and the validity of the ransomware group’s extortion claims have not been independently established by county officials.

The incident demonstrates the security challenges facing municipal governments as criminal groups pursue sensitive information held in public-sector systems, including situations where essential government services remain available despite a confirmed compromise.

---

---

Anne Arundel County Government, Anne Arundel County Provides Updates on 2025 and 2026 Data Privacy Events, October 15, 2026. (Free Download)

---

---

---

Anne Arundel County Government, Cyber Incident, official cybersecurity incident information and public guidance, updated October 16, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---