Anne Arundel County reviews August breach for exposed resident data after ransomware claim

Anne Arundel County, Maryland, confirmed that hackers stole files from government systems during an incident detected in late August. Officials stated that an unauthorized actor gained access to a limited subset of the county computer network and copied certain files. This confirmation follows a claim by the Rhysida ransomware group, which threatened to leak two point six terabytes of documents unless a ransom was paid.

The risk

County officials discovered irregular activity on August twenty eighth and immediately began an investigation. Through their response efforts, they determined that the intruder accessed a limited number of systems. The scope of the breach remains under review, with investigators working to assess exactly how much data was exposed. The county has notified federal law enforcement and other government agencies about the incident.

Who is exposed

The Baltimore suburb is home to more than six hundred thousand residents and includes the state capital of Annapolis. Dozens of federal agencies maintain offices or headquarters in the county, including the Defense Department, the Internal Revenue Service, and the Environmental Protection Agency. County officials did not specify what types of data were stolen but are reviewing the files to see if any relate to county residents.

Cost and compliance

The Rhysida ransomware gang demanded two million dollars to prevent the leak of the stolen documents. This group has repeatedly targeted governments globally, with previous victims including the city of Seattle, Columbus, Ohio, and Maryland’s transportation department. The county recently dealt with a separate ransomware attack last year that forced system shutdowns, but officials confirmed the August incident is distinct from that earlier event.

What happens next

Managers should monitor official county communications for updates on the scope of the data exposure. Verify whether any supplier contracts or resident data were included in the stolen files. Prepare internal teams for potential notification requirements if resident information is confirmed to be compromised.

Questions to ask your suppliers

Organizations should ask suppliers whether they experienced similar irregular activity during the same timeframe. Determine if any shared data repositories were accessed by unauthorized actors. Check whether the supplier has notified its own clients about potential exposure. Ensure that internal legal and compliance teams are aware of any new risks. Verify that contact protocols for incident notification are up to date. Ask whether the supplier can provide details on the specific systems affected. Confirm that all shared credentials have been rotated or reviewed.

What to do and how to stay safe

• Review access logs for any unusual activity on systems connected to county networks.
• Verify that all employee devices are patched and protected against known ransomware tactics.
• Monitor official channels for updates on the specific types of data that may have been stolen.
• Ensure that incident response plans include procedures for notifying affected individuals if personal data is compromised.

Step-by-step guide: Data Breach Myths: Why Common Security Beliefs Fail

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Rhysida ransomware steal data from Anne Arundel County?

Yes, county officials confirmed that an unauthorized actor copied files from government systems in August.

How much data was stolen in the Anne Arundel County breach?

The Rhysida group claimed to have stolen two point six terabytes of documents.