Key points
- Anne Arundel County confirmed an intruder accessed a limited subset of systems and copied files in late August.
- The Rhysida ransomware group claimed responsibility, threatening to leak 2.6 terabytes of documents unless a $2 million ransom was paid.
- Investigators are currently reviewing the stolen material to determine if any data relates to county residents or federal agencies.
The short version
- Officials in Anne Arundel County, Maryland, confirmed that an unauthorized actor gained access to government computer systems during an incident in August.
- The Rhysida ransomware gang claimed responsibility for the breach, stating they stole 2.6 terabytes of documents and demanded a $2 million ransom.
- County investigators are working to assess the scope of the exposure and determine whether any stolen information pertains to local residents.
The details
Officials in Anne Arundel County confirmed that hackers stole files from government systems during an incident in August, according to The Record. A county spokesperson stated that irregular activity was discovered on 28 August, prompting an investigation into a limited subset of systems within the county computer network. Through the response process, it was determined that an unauthorized actor gained access to these specific systems and copied certain files.
The spokesperson did not specify what type of data was involved in this particular incident. However, investigators are currently reviewing the stolen files to determine whether any of the information relates to residents of the county. The county has notified federal law enforcement and other government agencies about the breach. The Baltimore suburb is home to more than 600,000 residents and hosts the state capital of Annapolis, as well as numerous federal agency offices.
The context
The attack was claimed by the Rhysida ransomware gang, which threatened to leak 2.6 terabytes of documents stolen from the county if a $2 million ransom was not paid, according to The Record. This group has repeatedly targeted governments globally since emerging several years ago. Previous victims include Kuwait’s Finance Ministry, the city of Seattle, the city of Columbus in Ohio, and the transportation department of Maryland. Rhysida recently attempted to extort the government of Berlin after stealing emails and contracts.
This incident is separate from a ransomware attack the county dealt with last year, which forced the shutdown of multiple systems. In a separate development, the county released a statement regarding last year’s attack, announcing plans to send breach notification letters about leaked data from that earlier incident on 19 October. A county spokesperson clarified to The Record that the 28 August attack is a distinct event.
Defender's checklist
Organisations should monitor for irregular activity on internal networks, particularly on systems containing sensitive government or resident data. It is essential to maintain isolated backups of critical files to mitigate the impact of potential file copying or encryption. Security teams should verify that access controls are strictly enforced on subsets of the network to limit lateral movement by unauthorized actors. Furthermore, establishing clear communication channels with federal law enforcement and other agencies ensures a coordinated response when a breach is confirmed.
If your data is involved
Residents should remain vigilant for unsolicited communications claiming to be from county officials or ransomware groups. Scammers often exploit confirmed breaches to trick individuals into revealing personal information or paying fake ransoms. Check your email spam folder for suspicious messages asking for urgent action or verification. Do not click on links or download attachments from unknown senders. If you receive a letter or email about this specific incident, verify its authenticity through official county channels before taking any action. Monitor your financial accounts for unusual activity.
What to do and how to stay safe: Rhysida
- Monitor official county communications for updates on which specific types of data may have been exposed.
- Review your credit reports and financial statements for any unauthorised transactions or new accounts.
- Enable multi-factor authentication on your personal email and financial accounts to protect against credential theft.
- Be cautious of phishing emails that reference this breach, as attackers often use real incidents to lure victims.
Step-by-step guide: Credential Leaks: How Exposure Happens and How to Contain It
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What kind of data was stolen in the August breach?
The county has not yet specified the type of data involved, but investigators are reviewing the files to see if they relate to residents.
Is this the same attack as last year's ransomware incident?
No, a county spokesperson confirmed that the August 28 attack is a separate incident from the breach that occurred last year.
Did the county pay the ransom demanded by Rhysida?
The source material does not state whether the county paid the $2 million ransom demanded by the Rhysida group.
