Anne Arundel County confirms breach; Rhysida claims 2.6TB

Anne Arundel County, Maryland — a Baltimore suburb of more than 600,000 residents — has confirmed to Recorded Future News that an unauthorized actor "gained access to a limited number of systems and copied certain files from those systems" in an August incident. The Rhysida ransomware gang has claimed the attack on its leak site, listing it around October 9 and threatening to publish the stolen data unless a ransom is paid.

What the county confirmed

• Victim: Anne Arundel County government.
• Access: An intruder reached "a limited number of systems" and copied files. The county has not said what data was in them; investigators are still reviewing the copied files.
• Timeline: The county detected "irregular activity" on August 28. It notified federal law enforcement and other agencies.
• Primary source: There is no published written county advisory yet — the confirmation came as a spokesperson statement to Recorded Future News. Treat the detail below as it stands until a formal notice or regulator filing lands.

The county stresses this is a separate incident from a 2025 ransomware attack, when intruders were in a limited subset of its network between January 28 and February 22 and may have accessed names, addresses and medical information. No group publicly claimed that earlier attack.

Rhysida's claim

Rhysida's leak-site post claims roughly 814,500 files totaling 2.6 TB, reportedly including medical faxes, documents with Social Security numbers, payroll and HR records, and jail files, with a $2 million ransom demand. None of that scope is confirmed by the county, which has not addressed the figures. Read the 2.6 TB / 814,500-file count as Rhysida's allegation and the "limited number of systems" description as the only official characterization so far.

Status

• No evidence yet of what, if anything, was published; the listing is an extortion lever, not proof of release.
• The county has not said whether it will pay, and no notification letters to residents have been reported.
• No CVE or specific initial-access vector has been tied to the incident publicly.

Action checklist

1. Anne Arundel residents and county staff: assume name, SSN and other PII may be exposed. Freeze credit at all three bureaus and watch for county- or tax-themed phishing.
2. IR teams at agencies that share data with the county (health, courts, law enforcement): treat any files exchanged as potentially in the 2.6 TB set and scope downstream exposure now, before the leak-site clock runs out.
3. Watch for breach-notification lures. Fake "Anne Arundel County data breach" notices with monitoring-enrollment links are the predictable next step.

Context

Rhysida has spent 2026 working US public-sector and healthcare targets, the pattern CISA and the FBI flagged in their joint advisory on the group. A county hit twice by ransomware inside two years — by different actors — is the shape of the problem: local governments hold dense PII, run flat networks on thin security budgets, and surface the breach through a leak-site listing weeks before any official count. The gap between Rhysida's 2.6 TB claim and the county's "limited number of systems" is the number to watch as the review finishes.