Anne Arundel County, Maryland, confirms files copied in August attack after Rhysida ransomware claim

TLDR

• Anne Arundel County, Maryland, confirmed on 15 October that an unauthorised actor copied files from its systems in August.¹²
• The Rhysida ransomware gang claimed the attack, demanding $2 million and threatening to leak 2.6 terabytes of documents.¹
• The county has not confirmed the claim or said what data was taken, and says operations were unaffected.¹²

County officials said on 15 October that they were investigating after detecting irregular activity on some systems on 28 August, according to The Baltimore Banner, which cited a news release from County Executive Steuart Pittman's office.² The Record reports that a spokesperson said the county determined an unauthorised actor had accessed a limited number of systems and copied certain files, and did not respond to questions about what data was involved.¹ The county has notified federal law enforcement, and the Banner reports the release said there is no indication the files have been used for fraud or identity theft.¹²

The Record says the attack was claimed by the Rhysida ransomware gang, which set a $2 million ransom and threatened to leak 2.6 terabytes of stolen documents.¹ The Banner cites the ransomware.live tracking site as reporting that a hacker group claimed to have copied files including "medical faxes", "HR memos" and "tax forms and bank data", and says it could not verify those claims.² The county has not itself described the incident as ransomware in the statements quoted by either outlet.

The county said the attack is a "separate incident" from a cyberattack on its network between 28 January and 22 February 2025, which The Record describes as a ransomware attack by a different group and about which the county will notify affected individuals beginning 19 October.¹² The Banner also reports the county said the attack was unrelated to a Luminis Health incident reported on 2 September.²

The Record notes that Rhysida has repeatedly targeted governments, including Kuwait's Finance Ministry, Seattle, Columbus (Ohio) and Maryland's transportation department, and recently tried to extort the government of Berlin.¹ It also quotes the county spokesperson as saying recent reports indicate a surge in calculated cybercrimes targeting state and local governments.¹

Why it matters: the county, which The Record says has more than 600,000 residents, has confirmed that files were copied but not what they contain, so the main open question is whether resident or employee data is among them and whether the gang's leak threat is carried out.¹²

Update, 18 October 2026: Cybernews reports that Rhysida is now advertising the allegedly stolen 2.6 TB, which it says comprises 814,500 files, for sale on its leak site for 25 BTC, about $2 million at current exchange rates, rather than only threatening to leak it unless the $2 million ransom was paid.³ Cybernews quotes the listing as giving buyers "7 days on the clock" to bid and saying the data would be sold to one buyer only, and its summary says the gang claims the data includes medical, payroll, banking and jail records.³ These are the gang's claims: the county has still not said what data was taken, and The Record and The Baltimore Banner do not report a sale listing.¹²³ Cybernews otherwise matches the earlier reporting that the county detected activity on 28 August, says it copied certain files from a limited number of systems, and treats the August attack as separate from the 2025 incident for which notification letters begin the week of 19 October.¹³