Anne Arundel County, Maryland Confirms August Breach as Rhysida Claims 2.6TB Data Theft

Anne Arundel County Confirms August Intrusion, Rhysida Gang Claims 2.6TB Theft

Anne Arundel County, Maryland — home to the state capital of Annapolis and more than 600,000 residents — publicly confirmed on October 15-16, 2026 that an "unauthorized actor" breached a limited number of government systems and copied files, in an intrusion the county says it first detected on August 28, 2026. The disclosure came roughly seven weeks after the fact, and only after the Rhysida ransomware gang posted a claim to its dark-web leak site on October 9, 2026 asserting it had stolen 814,500 files totaling 2.6 terabytes and demanding a $2 million ransom not to publish them.

County officials have been deliberately sparse with details: a spokesperson for County Executive Steuart Pittman's office confirmed only that an "unauthorized actor gained access to a limited number of systems and copied certain files," and said there is "no indication so far" the stolen data has been used for consumer fraud or identity theft. The county has not confirmed which systems or data types were actually taken, has not named Rhysida or any other threat actor in its own statements, and has not confirmed or denied the gang's claimed file count or data volume — those figures come solely from Rhysida's own leak-site posting and third-party trackers such as Ransomware.live, and have not been independently verified by reporters at The Baltimore Banner or elsewhere. What is confirmed is that this is the county's second major cyber incident in roughly 18 months, following a separate, more disruptive ransomware attack in February 2025.

Incident Details

Attribute	Value
Victim	Anne Arundel County, Maryland government (population 600,000+; includes Annapolis)
Intrusion/discovery date	August 28, 2026 ("irregular activity" detected same day)
Public disclosure date	October 15-16, 2026
Suspected/claiming threat actor	Rhysida ransomware gang (claimed responsibility on its leak site; county has not confirmed attribution)
Leak-site claim posted	October 9, 2026
Data allegedly stolen (per Rhysida/Ransomware.live — unverified by county or press)	~814,500 files / 2.6 TB, said to include background-check dossiers with Social Security numbers, medical faxes spanning 2022-2026, methadone-clinic records, medical-assistance files with financial/ID documents, payroll and HR records, and jail gang-intelligence files
Data confirmed by county	Unconfirmed — officials say review is ongoing to determine if resident data was affected
Ransom demand	$2 million, per Rhysida's leak-site posting (unconfirmed by county)
Scope/operational impact	County says the incident "has not interfered with county operations" and is not expected to affect essential services
Related to prior incident?	County says this breach is a separate, unrelated incident from the February 2025 ransomware attack
Restoration status	Not applicable — county reports no operational disruption; data-review and notification process ongoing

What Happened

The August Intrusion

Anne Arundel County says it detected "irregular activity" on its computer network on August 28, 2026, and an investigation determined that an unauthorized actor had accessed a limited number of systems and copied certain files from them. The county notified federal law enforcement and other government agencies at the time, but did not make the incident public for nearly seven weeks. Officials have said the breach did not disrupt day-to-day county operations and is not expected to affect essential services — a notably different outcome from the county's prior 2025 incident (see below).

The Rhysida Ransomware Claim

On October 9, 2026, the Rhysida ransomware gang posted a claim to its Tor-based leak site asserting it had exfiltrated 814,500 files totaling 2.6 TB from Anne Arundel County, and set a $2 million ransom demand to prevent publication. According to the leak-site posting — tracked and summarized by third-party monitors including Ransomware.live — the claimed haul includes 721 background-check dossiers containing full Social Security numbers, medical faxes dated 2022 through 2026, records tied to a methadone clinic (subject to strict federal confidentiality rules), roughly 47,602 medical-assistance files with identity documents and financial information, county payroll, HR, and pension records, and jail gang-intelligence files. It is important to stress that these specific figures and data categories are Rhysida's own claims, relayed by a dark-web leak-site tracker — they have not been confirmed by Anne Arundel County and could not be independently verified by The Baltimore Banner or other outlets that covered the disclosure. Some leak-site trackers also cited related infostealer activity (compromised employee and third-party credentials) as circumstantial context for how initial access may have occurred, though this too remains unconfirmed as the intrusion vector.

The County's Response

Facing the public leak-site claim, the county acknowledged the breach but kept its statement narrow. A spokesperson for County Executive Steuart Pittman said the files are still being reviewed to determine whether any stolen information relates to county residents, and that notifications will follow once that review concludes. Officials reiterated there is "no indication so far" that any stolen data has been used for consumer fraud or identity theft, and declined to confirm the file types, data volume, or ransom demand reported by the gang.

Echoes of a Separate 2025 Breach

The timing is awkward for the county: officials have separately confirmed they plan to begin mailing breach-notification letters around October 19, 2026 for a different, more severe ransomware attack from February 2025. In that earlier incident, the county's chief information security officer said threat actors first gained access on January 28, 2025 via a compromised account, then attempted to deploy ransomware on February 22, 2025; endpoint detection blocked the ransomware payload itself, but the attackers deleted data on some drives. That attack forced county government buildings to close for a day and temporarily shut down recycling centers and AARP tax-assistance programs. Health data — names, addresses, and medical diagnoses, though likely not financial details — was reportedly involved. County officials have explicitly stated the new August 2026 breach is not related to the 2025 incident, meaning Anne Arundel County is now managing two distinct cyber incidents' disclosure and notification processes in the same month.

Impact Assessment

Impact Area	Description
Resident data exposure	Unconfirmed by the county, but Rhysida's claims — if accurate — would include highly sensitive categories: Social Security numbers, medical records, methadone-clinic treatment data, and financial/identity documents.
Disclosure timeline	Roughly seven weeks elapsed between the county's August 28 detection and its public confirmation in mid-October, and the confirmation itself arrived only after the gang's leak-site claim forced the issue.
Operational continuity	Unlike the 2025 incident, the county says this breach did not disrupt government operations or essential services — a comparatively limited operational blast radius, even if the data-theft claims are large.
Sensitive-records confidentiality	If methadone-clinic and background-check records were genuinely taken, as claimed, those categories carry heightened federal confidentiality obligations (e.g., 42 CFR Part 2 for substance-use treatment records), raising the regulatory stakes beyond a typical PII breach.
Compounding disclosure burden	The county is simultaneously handling notification for the unrelated February 2025 breach (letters expected around October 19) and reviewing this August 2026 incident — overlapping communications risk confusing residents about which breach affects them.
Verification gap	Nearly all of the specific numbers in public reporting (file counts, data volume, ransom amount, data categories) trace back to the threat actor's own leak-site claim, not county confirmation — a reminder that ransomware-gang statements are marketing for extortion, not verified fact.

Recommendations

For Anne Arundel County Residents

Do not wait for a breach notification letter to act — if you have interacted with county health, social-services, background-check, or payroll systems, consider placing a credit freeze or fraud alert with the major credit bureaus as a precaution.
Watch for two separate notification processes from the county in the coming weeks: one tied to the February 2025 incident (letters expected around October 19) and a potential future one tied to this August 2026 breach once the county's data review concludes. Read any notice carefully to understand which incident it references.
Be skeptical of unsolicited calls, texts, or emails referencing county services, medical appointments, or benefits in the aftermath of this disclosure — breach disclosures are reliably followed by phishing campaigns that impersonate the breached organization.

For County Employees

If your payroll, HR, or pension information may have been among the files Rhysida claims to have copied, monitor your pay and benefits accounts closely and consider enrolling in any identity-monitoring service the county offers in connection with this incident.
Report any suspicious login attempts, password-reset prompts, or unfamiliar MFA requests on county accounts immediately, given the leak-site claims referenced compromised employee credentials as a possible contributing factor.

For Government Security Teams

Treat ransomware leak-site claims as a forcing function, not a reliable fact sheet — Anne Arundel's confirmation only came after the gang posted its claim publicly, underscoring the value of proactively disclosing on the organization's own timeline rather than reacting to extortion pressure.
Segment and tightly restrict access to the most sensitive record categories a county handles — substance-use treatment records, background-check dossiers, and jail intelligence files carry outsized regulatory and reputational risk if a general network intrusion reaches them.
A second major incident within roughly 18 months is a signal, not a coincidence: review whether remediation from the February 2025 attack (credential resets, EDR coverage, network segmentation) was fully completed and audited before concluding this is an unrelated, independent failure.

Key Takeaways

Anne Arundel County, Maryland confirmed on October 15-16, 2026 that an unauthorized actor accessed systems and copied files in an intrusion first detected August 28, 2026 — a disclosure that came only after the Rhysida gang posted its own claim.
The Rhysida ransomware gang claims to have stolen 814,500 files (2.6 TB) and is demanding $2 million, but the county has not confirmed the file count, data volume, data types, or ransom amount — those numbers are the gang's claims, relayed by leak-site trackers, not verified facts.
Claimed data categories include background-check dossiers with Social Security numbers, medical and methadone-clinic records, medical-assistance files, payroll/HR records, and jail gang-intelligence files — none of which the county has independently confirmed as taken.
The county says the breach did not disrupt operations or essential services, and there is "no indication so far" of resulting consumer fraud or identity theft.
This is Anne Arundel County's second significant cyber incident in about 18 months; officials say it is unrelated to a more disruptive February 2025 ransomware attack, for which breach-notification letters are separately expected around October 19, 2026.
Residents and county employees should prepare for two distinct, overlapping notification processes and treat any breach-related outreach with caution given the elevated phishing risk that typically follows public disclosures like this one.