Anne Arundel County, Maryland, has confirmed that an unauthorized actor accessed some of its government systems and copied files during a cyberattack on August 28, 2026.
The Rhysida ransomware gang has claimed responsibility for the incident and is threatening to leak or sell approximately 2.6TB of allegedly stolen data unless the county pays a $2 million ransom, according to Recorded Future News.
According to the county’s official cyberincident update, officials detected suspicious activity affecting a limited number of systems and immediately took steps to secure the network. The investigation determined that an unauthorized actor had accessed some systems and copied certain files. Anne Arundel County has more than 600,000 residents and includes Annapolis, Maryland’s state capital.
Rhysida claims the stolen data consists of approximately 814,500 files totaling 2.6TB. According to reports about the gang’s dark web listing, the allegedly stolen material includes medical faxes containing patient names and diagnoses, Social Security numbers, driver’s licenses, immigration documents, and banking information. The group also claims to possess county payroll records, employee salaries, pension details, disciplinary databases, jail intelligence records, and sensitive information associated with methadone treatment services. These claims have not been independently verified by the county.
The ransomware gang is reportedly demanding $2 million and threatening to release the files if the ransom is not paid. Its listing advertises the data for 25 bitcoin and claims that a buyer would receive exclusive ownership. However, county officials have declined to confirm the specific information the group claims to have stolen. Investigators are continuing to review the affected files to determine their contents and whether residents’ personal information is involved. The county has also notified federal law enforcement and other government agencies.
In its official statement, the county said the August incident did not interfere with government operations and that no impact on essential services is anticipated. Officials are continuing to investigate the incident and assess the information involved. The county has not publicly confirmed the ransomware group’s claims about the volume or nature of the allegedly stolen data.
The August 2026 incident is separate from an earlier cyberattack that affected the county’s network between January 28 and February 22, 2025. Following a review of files involved in that earlier incident, the county announced that it would begin sending notification letters to potentially affected individuals during the week of October 19, 2026. According to the county’s data privacy notice, information potentially involved in the 2025 incident varies by individual and may include personal identifiers, financial account details and medical information.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Rhysida has previously claimed attacks against government organizations around the world. According to Recorded Future News, the group’s previous targets include the cities of Seattle and Columbus, Ohio, as well as Kuwait’s Ministry of Finance. The group has used threats to publish allegedly stolen information as part of its ransomware and data-extortion operations.
Rhysida Ransomware Gang Claims Theft of 2.6TB of Data From Maryland County
