Anne Arundel County Probes Second Cyber Intrusion in Two Years

Key Takeaways

• Anne Arundel County is investigating unauthorized access and file copying discovered on August 28, 2026.
• Rhysida claims it took 2.6 TB across 814,500 files, but Anne Arundel County has not verified the claim or identified affected data.
• Essential services remained operational, while the two incidents highlight the rising financial and operational burden of county cybersecurity.

Anne Arundel County is investigating a cyber incident involving unauthorized access to its network and the copying of files, adding another security challenge after a separate attack in early 2025. Officials discovered the newer activity on August 28, 2026, notified federal law enforcement and began working to determine what systems and information may have been affected.

Essential public services were not disrupted, according to Anne Arundel County. That distinction matters because ransomware attacks against local governments can interfere with public safety, courts, tax collection, permitting and benefit administration. Keeping those functions available limits the immediate operational damage, but it does not answer the harder questions about data exposure.

The investigation remains open, and Anne Arundel County has not confirmed the scope of the intrusion or the types of files involved. As reported by the Capital Gazette, the matter is one of two cyber incidents under examination. The earlier event occurred during January and February 2025.

Rhysida, a ransomware and data-extortion group, has claimed responsibility for stealing 2.6 TB of information consisting of 814,500 files. According to Cybernews, Rhysida alleged that the collection includes medical, payroll, banking and jail information. Those assertions have not been verified by Anne Arundel County, so the figures and data descriptions remain claims rather than confirmed findings.

That gap between an attacker's post and a victim's findings is common. Extortion groups have an incentive to exaggerate the value, sensitivity or completeness of stolen material. Digital-forensics teams, meanwhile, may need weeks or months to reconstruct access paths, determine which files were opened or copied, review logs and connect exposed records to individuals. A large file count does not automatically equal the same number of affected people.

County networks contain unusually varied information. A single environment may support payroll, corrections, public health, financial transactions and citizen-facing services. If copied files span several departments, Anne Arundel County could face a complicated notification process involving different legal requirements and retention practices. Who owned each dataset, and how accurately was access recorded? Those questions can shape both the investigation and the eventual response.

Comparable incidents show how wide that exposure can become. GovTech reported that Catawba County, North Carolina, said its 2025 attack potentially exposed Social Security numbers as well as financial, medical and insurance information, although emergency systems were not compromised. Union County, Ohio, separately notified 45,487 people following a 2025 incident involving identifiers, financial and medical information, fingerprint data and payment-card details.

Anne Arundel County was already confronting the cost of cybersecurity remediation. Following the 2025 attack, the county executive proposed $4.3 million in information-technology improvements. For county governments, that kind of spending competes with roads, staffing and public programs, yet delayed upgrades can leave older systems and fragmented identity controls in place.

The NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals offer useful reference points for the next phase. Their core practices include multifactor authentication, vulnerability remediation, tested backups and incident-response planning. None eliminates risk. Together, though, they can reduce an attacker's room to move and give staff clearer procedures when suspicious activity appears.

For Anne Arundel County, the immediate priority is establishing what happened and whether residents, employees or other parties require notification. The broader business lesson is less comfortable. Service continuity is only one measure of impact. Data review, legal work, system rebuilding, credit monitoring and long-term security investment can continue well after public systems appear to be operating normally.