Anne Arundel County confirms August data breach after Rhysida claim

Anne Arundel County, Maryland, has confirmed an Anne Arundel County data breach: an unauthorized actor copied files from county systems in August, according to The Record. The Rhysida ransomware gang claimed the attack and demanded $2 million. The county has not said what data was taken or whether residents are affected.

What we know

• The county says it spotted “irregular activity” on August 28 and started an investigation.
• It describes the intrusion as limited to a small number of systems, from which certain files were copied.
• Federal law enforcement and other government agencies were notified, per The Record.
• Investigators are still reviewing the copied files to decide whether they contain resident information.
• The county says this is a separate incident from a ransomware attack it suffered last year.

Who is affected

The county has more than 600,000 residents and includes the state capital, Annapolis. Many federal agencies also have offices there. The county has not said what data was involved, so the population affected, if any, is not disclosed.

The county has said it plans to send breach notification letters on October 19, but that relates to last year’s attack, not this one.

What has not been confirmed

• Rhysida’s claim of 2.6 terabytes of stolen documents comes from the group itself. The county has not verified the size or content.
• What kinds of files were copied is not disclosed.
• Whether any resident, employee or federal-agency data is included is not disclosed.
• Whether the files have been published is not stated in the report.

Why this matters

Analysis, not new facts. A confirmed theft plus a ransom demand usually means data leak-site publication is a real possibility if no payment is made. The county has been hit twice in about a year, which suggests that cleanup after the first incident may not have closed every gap, though the sources do not say how access was gained. The county spokesperson also pointed to a surge in attacks on state and local governments, and The Record notes outages at cities and counties in several US states over the past two weeks. Rhysida has previously targeted governments, per the same report.

Because the county describes the access as limited to a few systems, defenders elsewhere should ask the same question of their own networks: which file shares hold resident, employee or case data, and would you notice if someone copied them in bulk? Sensitive repositories deserve tighter logging and segmentation than general office storage.

What to do

For residents and county staff:

1. Watch for official notices from the county and treat unexpected calls or emails referencing the breach with suspicion.
2. Use unique passwords and enable multi-factor authentication on accounts tied to county services.
3. Consider a credit freeze if you later receive a notification letter that lists your personal data.

For security teams at local governments:

1. Review remote access, VPN and administrator accounts for unusual logins, and rotate credentials where access is in doubt.
2. Hunt for large outbound transfers and archive-creation tools on file servers, since the attack involved copying files out.
3. Check that backups are offline and tested, and that incident response contacts, including federal law enforcement, are ready.
4. Monitor ransomware leak sites for your organization’s name so you learn of any publication early.

Sources

• The Record: Baltimore suburb confirms August data breach after ransomware claims