A cyberattack on Anne Arundel County in Maryland has developed into a major data security concern after the Rhysida ransomware group claimed to have stolen sensitive government records. The hackers are now attempting to sell the information for approximately $2 million, raising concerns about the possible exposure of residents’ personal and medical details.
County officials confirmed that unauthorized individuals accessed government systems during an incident discovered on August 28, 2026. An investigation determined that files were copied from a limited number of computers, although authorities have not disclosed exactly what information was taken.
Rhysida has claimed responsibility and advertised the alleged stolen material on its dark web leak site. The group says it obtained approximately 2.6 terabytes of information, consisting of more than 814,000 files, and is demanding 25 Bitcoin in exchange for the data.
According to the attackers, the collection includes medical records, Social Security numbers, driver’s licenses, banking information, and government employee details. The group also claims to possess payroll documents, pension records, jail intelligence files, and information associated with a methadone treatment clinic.
These claims have not been independently verified. County officials are still examining the compromised files to establish their contents and determine whether residents’ personal information was affected.
Anne Arundel County, which includes Maryland’s capital, Annapolis, serves approximately 600,000 residents. Despite the confirmed intrusion, officials said the incident did not disrupt government operations or essential public services.
The county also experienced a separate cyberattack in February 2025. However, authorities have stated that the August intrusion is unrelated to that earlier incident, which caused more significant operational problems.
Rhysida has operated since 2023 and is known for targeting government agencies, healthcare providers, educational institutions, and private businesses. The group frequently attempts to pressure victims by threatening to publish or sell stolen information unless its financial demands are met.
The possible exposure of medical and financial records is particularly concerning because such information could be exploited for identity theft, targeted phishing, or other forms of fraud. Nevertheless, the existence of the advertised files does not establish that the information has already been misused.