Anne Arundel County Confirms August Ransomware Breach as Rhysida Sells 2.6TB for 25 BTC

Anne Arundel County, Maryland, has confirmed that an unauthorized actor copied files from a limited number of county government systems during an incident detected on August 28, 2026. The confirmation came after the Rhysida ransomware gang claimed responsibility and began advertising 2.6 terabytes of allegedly stolen data for sale on its dark web leak site. The county, home to more than 600,000 residents and the state capital of Annapolis, is located near Washington, D.C., and hosts offices or headquarters for dozens of federal agencies, including the Defense Department, the Internal Revenue Service, the Environmental Protection Agency, the Social Security Administration, the Department of Agriculture and the U.S. Coast Guard.

Recorded Future News reported on October 16, 2026, that a county spokesperson described the discovery of irregular activity on August 28 and an investigation that focused on a limited subset of systems within the county computer network. The spokesperson said that through the course of the county's response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems. The spokesperson did not answer questions about what specific data was involved but said investigators are reviewing the files to determine whether any stolen information related to residents.

The Rhysida gang has claimed the attack and is selling the archive for 25 bitcoin, which is approximately $2 million at current exchange rates. Cybernews reported on October 17, 2026, that the gang says it stole 2.6 terabytes of data comprising 814,500 files. The alleged data includes tens of thousands of medical faxes with patients' names and diagnoses, Social Security numbers, driver's licenses, Green Cards and banking information, county payroll registers, employee salaries, pension information and disciplinary databases, jail intelligence records including information about alleged gang members, and methadone clinic records, which the gang claims fall under federal confidentiality protections for substance-use treatment information.

Rhysida also threatened to leak the data if a $2 million ransom was not paid. On its dark web site, the gang posted a message urging buyers to act within seven days: With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner! The county is separately preparing to notify residents about a different cyberattack that took place between January 28, 2025, and February 22, 2025. A spokesperson said the August 28 incident is a separate event.

Key Facts

Anne Arundel County detected irregular activity on August 28, 2026, and later confirmed that an unauthorized actor copied files from a limited number of government systems.

Rhysida claims it stole 2.6 terabytes of data, or 814,500 files, including medical faxes, Social Security numbers, driver's licenses, Green Cards, banking information, payroll registers, employee salaries, pension information, disciplinary databases, jail intelligence records, and methadone clinic records.

The gang is advertising the archive for 25 bitcoin, worth approximately $2 million, and has demanded a $2 million ransom to prevent a leak.

The county has more than 600,000 residents and includes Annapolis, the state capital. Dozens of federal agencies have offices or headquarters in the county, including the Defense Department, the Internal Revenue Service, the Environmental Protection Agency, the Social Security Administration, the Department of Agriculture and the U.S. Coast Guard.

Recorded Future News reported on October 16, 2026, that county officials notified federal law enforcement and other government agencies. Infosec Builder reported on October 18, 2026, that the county is still determining who was affected and that breach notification letters for the 2025 incident will begin going out the week of October 19, 2026.

Analysis

What this really means is that a single county government with more than 600,000 residents has become the latest target in a sustained campaign by ransomware groups against state and local governments. Rhysida has repeatedly targeted governments, with prior victims including Kuwait's Finance Ministry, the city of Seattle, the city of Columbus, Ohio, and the Maryland Department of Transportation; it recently attempted to extort the government of Berlin. In January 2025, Rhysida claimed to have breached the Canadian municipal government of Montréal-Nord, advertising allegedly stolen data for 10 BTC, roughly $1 million. The Anne Arundel County case follows that pattern but with a larger data volume and a higher price tag.

The sensitivity of the allegedly stolen data elevates the stakes. Medical faxes with diagnoses, Social Security numbers, Green Cards, banking details, jail intelligence records about alleged gang members, and methadone clinic records are not ordinary government files. The methadone clinic records, if accurate, would fall under federal confidentiality protections for substance-use treatment information. That means the breach could expose individuals to identity theft, financial fraud, and, in the case of jail intelligence, physical danger. The county has not yet confirmed which residents are affected, but the gang's inventory suggests a broad and deeply personal data set.

The bigger picture here is that the county is dealing with two separate incidents at once. The August 28 attack is distinct from a 2025 intrusion whose notification letters are scheduled to go out starting the week of October 19, 2026. A spokesperson said the August 28 attack is a separate incident. Managing overlapping breach responses strains resources and can confuse residents. The timing also risks compounding public distrust, as people may receive letters about the 2025 breach while the 2026 incident remains under investigation. The county's decision to notify federal law enforcement is appropriate, but federal agencies may also be concerned because many have offices or headquarters in the county.

Rhysida's tactic of selling to one buyer for 25 bitcoin instead of only demanding a ransom is notable. The gang is offering exclusive ownership of the data, which may appeal to other criminals or even to parties seeking to suppress the information. The seven day countdown creates urgency. If no buyer emerges and no ransom is paid, the gang has threatened to leak the data. For Anne Arundel County, the choice is not simply whether to pay but how to mitigate harm from a leak that could include law enforcement sensitive material.

Why It Matters

The breach matters because it affects a population of more than 600,000 people and involves data that can be used for identity theft, financial crime, and targeting of individuals. The county is still reviewing the files to determine whether any stolen information related to residents. Until that review is complete, residents do not know if their Social Security numbers, medical histories, or banking details are in the hands of criminals.

It also matters because Anne Arundel County hosts dozens of federal agencies, including the Defense Department, the Internal Revenue Service, the Environmental Protection Agency, the Social Security Administration, the Department of Agriculture and the U.S. Coast Guard. While the county said the intrusion was limited to a subset of its own systems, the proximity of federal operations raises questions about potential reach. The county notified federal law enforcement and other government agencies, which is a necessary step.

More broadly, the incident reflects a surge in calculated cybercrimes specifically targeting state and local governments. Recorded Future News reported on October 16, 2026, that cities and counties in New Mexico, Utah, Texas, Nebraska, Missouri and Arizona have all dealt with service outages over the last two weeks due to cyberattacks. Anne Arundel County is not an isolated case. Local governments often have smaller security budgets and older systems, making them attractive targets for groups like Rhysida.

Next Up

The county will begin sending breach notification letters for the 2025 incident during the week of October 19, 2026. That process will run in parallel with the ongoing investigation into the August 28, 2026, attack. Investigators are still reviewing the copied files to determine whether any stolen information related to residents, and the county has not provided a timeline for completing that review.

Rhysida's seven day auction clock is ticking. If no buyer pays 25 bitcoin and no $2 million ransom is paid, the gang has threatened to leak the 2.6 terabytes of data. Federal law enforcement is involved, and the outcome will be closely watched by other state and local governments facing similar threats.