Maryland Suburb Reports File Theft After Ransomware Claim
Anne Arundel County, Maryland officials confirmed that an unauthorized actor copied files from county systems on August 28. A spokesperson told Recorded Future News that investigators discovered irregular activity and began examining a limited subset of systems within the county network. The Rhysida ransomware gang claimed the attack and threatened to leak 2.6 terabytes of documents unless the county paid two million dollars. Investigators are now reviewing the stolen files to determine whether any data relates to county residents.
What the county disclosed
A county spokesperson told Recorded Future News that irregular activity was discovered on August 28 on a limited subset of systems. The investigation determined that an unauthorized actor gained access to a limited number of systems and copied certain files.
Officials did not specify what types of data were involved. The spokesperson said investigators are currently reviewing the copied files to determine whether any stolen information is connected to county residents. The county notified federal law enforcement and other government agencies about the breach.
Rhysida gang claims responsibility
The attack was claimed by the Rhysida ransomware gang, which threatened to leak 2.6 terabytes worth of documents if a two million dollar ransom was not paid.
Rhysida has targeted government organizations across the globe since emerging several years ago. Its victims include Kuwait's Finance Ministry, the city of Seattle, the city of Columbus and Berlin's government. The group recently attempted to extort Berlin after stealing emails and contracts. Maryland's transportation department was also targeted by Rhysida.
Second breach in two years
Anne Arundel County experienced a separate ransomware incident the previous year involving a different attacker. That attack forced the county to shut down multiple systems.
On the same day officials confirmed the August incident, the county released a statement announcing plans to send breach notification letters about the earlier attack on October 19. A spokesperson confirmed that the August 28 attack is a separate incident.
Profile of the county
Anne Arundel County is home to more than 600,000 residents and Maryland's capital of Annapolis. Washington, D.C. is nearby. Dozens of federal agencies have offices or headquarters in the county, including the Defense Department, Internal Revenue Service, Environmental Protection Agency, Social Security Administration, Department of Agriculture and U.S. Coast Guard.
Wave of attacks on local governments
The Anne Arundel County spokesperson said recent reports point to a surge in these types of cybercrimes that deliberately focus on state and local governments. Multiple municipalities across New Mexico, Utah, Texas, Nebraska, Missouri and Arizona have dealt with service outages over the last two weeks due to cyberattacks.
Steps residents can take
County officials are reviewing the stolen files to determine which residents may be affected. If personal data was included in the copied files, the county may send breach notification letters.
Residents should watch for official communications from the county. If you receive a notification letter, follow the instructions for any offered services. Do not respond to unsolicited calls or emails claiming to be from the county about the breach. Verify any communication through the county's official website or phone number.
- Watch for official breach notification letters from the county
- Follow instructions in any notification letter you receive
- Ignore unsolicited calls or emails about the breach
- Verify all communications through official county channels
Questions readers ask
When did Anne Arundel County discover the data breach?
County officials discovered irregular activity on August 28 on a limited subset of systems within the county network. The investigation determined that an unauthorized actor copied certain files from those systems.
How much did the Rhysida ransomware gang demand?
Rhysida threatened to leak 2.6 terabytes of documents if a two million dollar ransom was not paid. The county has not stated whether it paid the ransom or negotiated with the attackers.
Is this the same breach from last year?
No. A county spokesperson confirmed that the August 28 incident is separate from a ransomware attack by a different group last year. The county plans to send breach notification letters for that earlier attack on October 19.
What should Anne Arundel County residents do now?
Watch for official breach notification letters from the county if your data was involved. If you receive a letter, follow the instructions provided. Verify any communication through the county's official website, not by responding to unsolicited emails or calls.
Why are local governments being targeted by ransomware groups?
A county spokesperson said recent reports indicate a surge in cyberattacks targeting state and local governments. Anne Arundel County is home to more than 600,000 residents and sits near Washington, D.C., with dozens of federal agencies maintaining offices or headquarters in the area.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.