Rhysida ransomware gang claims 2.6 TB theft from Maryland's Anne Arundel County

On 16 October 2026, Anne Arundel County, Maryland — the local government serving more than 600,000 residents in and around Annapolis, between Baltimore and Washington, D.C. — confirmed that an unauthorized actor had broken into its network and copied files, after the Rhysida ransomware group listed the county on its dark-web leak site. A county spokesperson told The Record that an intruder had accessed "a limited subset of systems within the county computer network" and copied certain files, and that the county had notified federal law enforcement and other government agencies.

The county said it first detected irregular activity on 28 August 2026 and immediately began investigating. On its leak site, Rhysida claimed to have exfiltrated roughly 2.6 terabytes of county data and threatened to publish it unless a $2 million ransom was paid. The county did not say whether it had paid or intended to pay, and officials declined to detail what information was involved, saying investigators were still reviewing the copied files to determine whether they contained data about county residents.

A separate incident

The spokesperson stressed that the August 2026 intrusion was a "separate incident" from a ransomware attack the county disclosed the previous year, which had been attributed to a different group. The earlier attack, detected in February 2025, had temporarily closed county government buildings and disrupted several services; officials said at the time that a limited portion of the network had been infiltrated and that some health-department data may have been exposed.

Context

Rhysida is a ransomware-as-a-service operation active since 2023 and known for extorting hospitals, schools, and government bodies, often by auctioning or leaking stolen files when victims refuse to pay. Its listing of Anne Arundel County fits a broader surge in cyberattacks against U.S. state and local governments, whose smaller security budgets and large stores of resident data make them attractive targets. As of the county's confirmation, the number of people affected and the specific categories of exposed data remained undetermined.