Breach · · 2 min read
Anne Arundel County confirms files were stolen in August attack
The Maryland county says an attacker copied files from some of its systems. The Rhysida ransomware gang claimed 2.6 TB and demanded $2 million. Resident data is still being reviewed.
Anne Arundel County, Maryland, home to more than 600,000 people and the state capital of Annapolis, has confirmed that hackers stole files from its systems in August. If you live in the county or do business with it, here’s what is known so far.
What happened
A county spokesperson told The Record that staff found “irregular activity” on August 28 on a limited set of county systems. The investigation found that an unauthorized actor “gained access to a limited number of systems and copied certain files.” The county is still reviewing the files to work out whether any resident information was in them, and has told federal law enforcement.
The Rhysida ransomware gang claimed the attack and threatened to leak 2.6 terabytes of documents unless it was paid $2 million. The county hasn’t confirmed what the files contain.
This is a separate incident from a different ransomware attack on the county last year. Separately, the county said it planned to send breach letters about data leaked in that earlier attack starting October 19.
What this means for you
Right now it isn’t known whether residents’ personal information was taken in the August attack. County governments hold a lot of it: property and tax records, permits, court and benefits paperwork, and staff files. If you get a letter, it may be about either incident, so read it closely.
What you can do
- Read any county letter carefully to see which incident it’s about and what it says was exposed.
- Be careful with messages claiming to be from the county about taxes, permits or fines. Go to the county’s official website yourself instead of clicking a link.
- Consider a free credit freeze with Equifax, Experian and TransUnion if a letter says your Social Security number was involved.
- Read up on scams built from leaked data: how scammers use leaked data.
How Frame helps
Frame keeps a catalog of known breaches. Once you know you were part of one, add it to a verified email and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.
Sources
- The Record, Baltimore suburb confirms August data breach after ransomware claims, October 16, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.