Anne Arundel County data breach investigators are reviewing files copied from a limited number of county systems after the Maryland government detected unusual activity on Aug. 28, 2026. The county says the incident did not interrupt operations and does not expect effects on essential services.
County officials said they acted to secure the affected part of the network and are still determining the scope and source of the activity. A spokesperson told Recorded Future News that an unauthorized actor accessed a limited number of systems and copied certain files.
The county has not identified the contents of those files. Its public incident page says the review is intended to establish what the files contain, whether they concern individuals and, if so, what information is associated with them. That is a considerably narrower statement than confirmation that residents’ personal data was exposed.
What happened in the Anne Arundel County data breach?
According to the county, irregular activity was found on a limited subset of its computer network on Aug. 28. It says it immediately took steps to secure the network while investigating the potential scope and origin of the activity.
Recorded Future News reported that county officials also notified federal law enforcement and other government agencies. The supplied reporting does not describe notification letters connected to the August incident.
A criminal group has made claims about Anne Arundel County on the dark web, the county said. Officials have declined to publicly verify or discuss the data the group says it took. The county’s confirmation establishes unauthorized access and copied files, but it does not establish the attacker’s identity or validate the group’s description of the material.
Rhysida claimed responsibility, according to Recorded Future News, and said it had 2.6 terabytes of county documents. The group also threatened to publish the material unless it received $2 million. Those are extortion claims, not findings independently confirmed by Anne Arundel County.
How does this differ from the county’s 2025 cyber incident?
The Aug. 28 event is separate from Anne Arundel County’s earlier data-privacy incident, the county and its spokesperson said. The county’s incident page describes suspicious activity discovered on Feb. 22, 2025, with unauthorized access occurring between Jan. 28 and Feb. 22 that year.
That earlier investigation found that files were accessed or downloaded without authorization. The county says it conducted a third-party review of those files and planned to begin sending notification letters during the week of Oct. 19, 2026. Its published list of potentially involved information categories applies to that 2025 event, not automatically to the August 2026 incident.
For the newer case, the facts remain limited: systems were accessed, files were copied, and the county is reviewing them. Any conclusion about whose information was involved, what it contained or whether Rhysida was responsible will have to wait for evidence the county has not yet released.
This story draws on original reporting from The Record.
