Baltimore Suburb Anne Arundel County Confirms Data Breach After Rhysida Ransomware Claims

County Confirms Attack After Rhysida Extortion Claim

Anne Arundel County, Maryland — a Baltimore-area suburb of more than 600,000 residents that includes the state capital of Annapolis — has confirmed it suffered a data breach after the Rhysida ransomware gang claimed responsibility and threatened to leak stolen files. A county spokesperson told Recorded Future News that officials discovered "irregular activity" on August 28, 2026, and launched an investigation into a limited subset of systems on the county's network.

"Through the course of the county's response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems," the county said.

Scope of the Claimed Theft

According to Rhysida's own claims — corroborated by follow-up reporting from Cybernews — the stolen data allegedly includes:

• Tens of thousands of medical faxes containing patient names and diagnoses
• Social Security numbers, driver's licenses, and Green Cards
• Banking information
• County payroll registers, including employee salaries and pension details
• Jail intelligence records, including information about alleged gang members

Anne Arundel County has not independently confirmed the specific contents of the stolen files and says it is still reviewing what was accessed to determine whether county residents' data was involved.

Why This County Is a High-Value Target

Anne Arundel County's footprint extends well beyond a typical municipal government. As the home of Maryland's state capital, the county hosts offices or headquarters for numerous federal agencies, including:

• The Department of Defense
• The IRS
• The EPA
• The Social Security Administration
• The Department of Agriculture
• The U.S. Coast Guard

County officials said they have notified federal law enforcement and other government agencies about the breach, reflecting the broader scope of the attack beyond purely local government data.

A Second Breach in Two Years

Notably, the county says this August incident is separate from an earlier ransomware attack it disclosed for early 2025. That prior incident involved unauthorized access between January 28 and February 22, 2025: attackers gained a foothold via a compromised account on January 28, and when they attempted to deploy ransomware on February 22, endpoint detection blocked the encryption — though the attackers still deleted data on some drives before being stopped. Breach notification letters for that earlier incident were scheduled to go out around October 19, 2026, meaning the county has been handling two overlapping disclosure processes for two distinct intrusions within roughly 18 months.

Rhysida itself is a familiar name in government-sector extortion: the gang has repeatedly targeted public-sector organizations globally and, separately, recently attempted to extort the government of Berlin after stealing troves of emails and contracts.

Why This Matters

• Repeat targeting of the same victim suggests either persistent gaps in the county's security posture or that initial remediation after the 2025 incident didn't fully close off the attacker's access routes
• Overlap of PII, health, financial, and law-enforcement data in a single alleged breach creates compounding risk — identity theft, targeted fraud, and safety concerns for individuals named in jail intelligence records
• Federal-agency co-location means a local government breach can have ripple effects reaching well beyond municipal operations
• Dual, overlapping disclosure timelines for two separate incidents complicate residents' ability to know which exposure affects them and when

Recommendations

For Affected Residents and Employees

• Monitor for breach notification letters tied to both the 2025 and 2026 incidents, as they may cover different data and timeframes
• Place a credit freeze or fraud alert if Social Security numbers or financial data are confirmed as compromised
• Watch for phishing attempts referencing county services, payroll, or court/jail records that could exploit the leaked data for social engineering

For Government IT and Security Teams

• Treat repeat intrusions against the same organization as a signal to audit whether prior incident-response remediation (credential rotation, access revocation, network segmentation) was fully completed
• Segment systems handling health, financial, and law-enforcement data from general administrative networks to limit blast radius in future incidents
• Maintain offline, tested backups for payroll, health-fax, and records systems given ransomware groups' pattern of targeting exactly this kind of data for extortion leverage

Anne Arundel County's second confirmed breach in under two years underscores how local governments — often under-resourced relative to the sensitivity and federal significance of the data they hold — remain high-value, repeatable targets for ransomware extortion groups.