Anne Arundel County says an intruder copied files from its systems
Anne Arundel County, Maryland, confirmed that an unauthorized actor copied files from its systems after detecting activity on August 28. The Rhysida ransomware gang claimed the attack, but the county has not said what was taken or whether residents are affected.
The Watch · Security desk
Three figures. Rhysida threatens to leak 2.6 terabytes of documents stolen from the county, per its claim, if a $2 million ransom is not paid; the ransom figure is marked disputed. Anne Arundel County has more than 600,000 residents.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Documents Rhysida threatens to leak, per its claim | 2.6 terabytes | 12 | |
| Ransom Rhysida demanded | 2,000,000 US dollars | disputed | 12 |
| County residents, over | 600,000 residents | 4 |
What happened
- Rhysida threatened to leak 2.6 terabytes of documents taken from the county unless a $2 million ransom was paid.
- The county did not answer questions about what data was involved. Investigators are reviewing the files to see whether any relate to residents.
- County officials said they notified federal law enforcement and other government agencies.
- A spokesperson called the August 28 attack a separate incident from last year's ransomware attack, which a different group carried out.
Why it matters
- What doesn't add up contradiction The county's wording points to a narrow theft and the gang's to a large one. Choosing between them will take an independent figure.
- Who's exposed exposure The county hosts dozens of federal offices, including the Defense Department, the IRS and the Coast Guard. Nothing reported links the files to those offices. The reporting ties the files to county systems, and the county is still checking whether any relate to residents.
- What it limits constraint The October 19 letters cover last year's attack. Any notice date for this one waits on the county's file review, and so do residents.
According to The Record, a county spokesperson put the confirmation this way: "Through the course of the county's response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems." [2] The county said it found "irregular activity" on August 28 and began investigating a "limited subset of systems within the county computer network." [1] The group's name, Rhysida, comes from the gang's own claim. [12]
The county's account is the public record: detection on August 28, files copied, law enforcement told. [1][2][5] The gang's claim is separate. The 2.6 terabytes and the $2 million demand are Rhysida's figures. [12] The spokesperson did not respond to questions about what data was involved. [3]
Rhysida has gone after governments repeatedly since it emerged several years ago. [7] Its victims include Kuwait's Finance Ministry, the city of Seattle, the city of Columbus, Ohio, and Maryland's transportation department. [7] It recently tried to extort the government of Berlin after stealing emails and contracts. [6] Its listing of Anne Arundel adds a county to that record.
The county spokesperson also pointed to a wider trend, saying recent reports "indicate that there has been a surge in these kinds of calculated cybercrimes specifically targeting state and local governments." [10] The Record listed cities and counties in New Mexico, Utah, Texas, Nebraska, Missouri and Arizona that have had service outages from cyberattacks over the last two weeks. [11]
What to watch
- Whether the county finishes its file review and says if resident data is involved, and when notices would go out.
- Whether Rhysida posts or samples the 2.6 terabytes, and when. A release would show what the files hold.
- Whether the county names the actor or calls the incident ransomware. Its quoted statement says only "an unauthorized actor."
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives55
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A county spokesperson said officials discovered "irregular activity" on August 28 and began investigating a "limited subset of systems within the county computer network."
- [2]
"Through the course of the county's response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems," the spokesperson said.
- [3]
The spokesperson did not respond to questions about what data was involved, but said investigators are reviewing the files to determine whether any stolen information related to county residents.
- [4]
Anne Arundel County has more than 600,000 residents and includes the state capital, Annapolis; dozens of federal agencies, including the Defense Department, IRS, EPA, Social Security Administration, Department of Agriculture and U.S. Coast Guard, have offices or headquarters there.
- [5]
County officials said they notified federal law enforcement and other government agencies about the data breach.
- [6]
Rhysida recently attempted to extort the government of Berlin after stealing troves of emails and contracts from government systems.
- [7]
Rhysida has repeatedly targeted governments since emerging several years ago; its victims include Kuwait's Finance Ministry, the city of Seattle, the city of Columbus, Ohio, and the transportation department of Maryland.
- [8]
A county spokesperson described the August 28 attack as a "separate incident" from last year's ransomware attack by a different group, which forced the county to shut off multiple systems.
- [9]
In a statement released Thursday evening about last year's attack, the county said it planned to send breach notification letters about leaked data from that incident on October 19.
- [10]
The spokesperson said recent reports "indicate that there has been a surge in these kinds of calculated cybercrimes specifically targeting state and local governments."
- [11]
Cities and counties in New Mexico, Utah, Texas, Nebraska, Missouri and Arizona have dealt with service outages over the last two weeks due to cyberattacks.
- [12]
The Rhysida ransomware gang claimed the attack and threatened to leak 2.6 terabytes of documents stolen from the county if a $2 million ransom was not paid.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- therecord.mediaBaltimore suburb confirms August data breach after ransomware claims
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- RhysidaFollow
- Recorded Future NewsFollow
- Anne Arundel CountyFollow