On October 15, Anne Arundel County published a press release that should have every county resident paying attention. The county confirmed it detected irregular activity on its computer network on August 28, and that an unauthorized actor had copied files from a limited number of systems. Nearly two months passed before the public learned about it. And the county still cannot say whose information, if anyone’s, was taken.
That silence is the story: the gap between what the county will confirm and what a ransomware group is loudly claiming on the dark web.
What the county has actually confirmed
According to the county’s own statement, issued from Annapolis on October 15, officials detected “irregular activity” on a limited subset of systems on August 28 and “took immediate action to secure the network.” The investigation found that “an unauthorized actor gained access to a limited number of systems and copied certain files from those systems.”
Here is what else the county put on the record:
- Third-party cybersecurity specialists are running a full digital forensics investigation.
- The intrusion did not disrupt county operations, and essential services are unaffected.
- There is currently “no indication the files have been used to commit any type of consumer fraud or identity theft.”
- The county is still reviewing the copied files to figure out what they contain and whether they relate to any individuals. Affected residents will be notified “in compliance with applicable law.”
- Federal law enforcement has been notified.
What the county has not said matters just as much. It has not named any ransomware group. It has not described what kinds of files were copied. And it has not confirmed that any resident’s personal information was involved at all. The county has not publicly addressed the ransomware group’s specific claims, according to The Banner’s reporting.
If you think you may be affected, the county’s published contact number is (410) 222-1821.
What the ransomware group is claiming (unverified)
Now the other side of the story. A ransomware group calling itself Rhysida has claimed responsibility for the attack on its dark-web leak site, according to threat intelligence firm Threadlinqs, which rates that attribution at medium confidence. The county has not confirmed any of this.
The group’s claims, as relayed by multiple security outlets, are dramatic: roughly 2.6 terabytes of data, some 814,500 files, now advertised for sale for 25 Bitcoin (worth around $2 million). The alleged contents include medical faxes, background-check dossiers, tax forms, bank data, payroll registers, and jail records. Every one of these details comes from the attackers themselves. The Banner explicitly reported it could not independently verify the claims, and the county has confirmed none of the volume or content figures.
The timing matters here: threat trackers picked up Rhysida’s claims in the days before the county’s October 15 statement, meaning the county confirmed the breach only after the attackers went public. Treat the Rhysida claims the way the county does: as unproven. But do not ignore them either. When a ransomware group puts data up for sale, the risk to residents goes up regardless of whether every claimed file is real. For context on how ransomware groups operate at this scale, our coverage of Denmark’s CPR breach shows what happens when attackers follow through.
What should Anne Arundel County residents do right now?
The county has not confirmed any resident data was stolen, but it is still reviewing the copied files while a ransomware group claims to be selling 2.6 TB of county data. If you live or pay taxes in Anne Arundel County, take protective steps now instead of waiting for a notification letter.
- Pull your free credit reports at AnnualCreditReport.com and scan for accounts or inquiries you do not recognize.
- Consider a credit freeze with all three bureaus. It is free under federal law and blocks new accounts from being opened in your name. Our step-by-step freeze guide walks through all three bureaus.
- Watch for phishing that references county services, tax payments, or jury duty. Attackers use stolen details to make scams convincing.
- Review bank and benefits statements for unfamiliar activity, and report anything suspicious to your bank or insurer.
- Get an IRS Identity Protection PIN at irs.gov. It blocks anyone else from filing a tax return with your Social Security number, which is stronger protection than just filing early.
There was also a 2025 incident, and its letters go out next week
The same October 15 press release covered a separate, earlier intrusion. Between January 28 and February 22, 2025, an unauthorized actor accessed county systems and downloaded files. A preliminary notice went out in May 2025, and the county says direct notification letters to affected individuals will start going out the week of October 19, 2026.
So if you receive a letter from Anne Arundel County in the coming days, check the dates carefully. It may be about the 2025 incident, not the August 2026 one. The two are separate events, and the county says there is currently no indication they are related.
One more thing the county wanted on the record: a September cyberattack at Luminis Health, which operates Anne Arundel Medical Center, is unrelated to the county network intrusion.
Bottom line: the county confirmed a real breach and is still figuring out the blast radius. The ransomware claims are loud but unverified. Residents should act on the confirmed facts, which are serious enough on their own. If your Social Security number may be involved, our SSN protection guide covers the next layer of defense.
