Threat reportRansomwareTL-2026-3744
Anne Arundel County (Maryland) Confirms August 2026 Data Breach After Rhysida Ransomware Claims
Anne Arundel County (Maryland) Confirms August 2026 Data (TL-2026-3744), also tracked as Anne Arundel County data breach, is a high-severity ransomware operation, first published 2026-10-16. It is attributed to Rhysida with medium confidence, affects Anne Arundel County Government County network systems and file stores, maps to 15 MITRE ATT&CK techniques (T1003.003, T1018, T1021.001), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1Rhysida
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-3744
- Threat ID
- TL-2026-3744
- Also known as
- Anne Arundel County data breach, Anne Arundel County Rhysida claim
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Rhysida
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- government administration, health, police - law enforcement
- Target regions
- North America, united states of america
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Anne Arundel County (Maryland) Confirms August 2026 Data
Malware and tooling: AnyDesk, STOP Ransomware, rhysida, Advanced IP Scanner, AnyDesk, AzCopy, GootLoader, PSEXEC
How Anne Arundel County (Maryland) Confirms August 2026 Data works
Anne Arundel County, Maryland confirmed that an unauthorized actor accessed a limited number of county systems and copied files after irregular activity was discovered on August 28, 2026. The Rhysida ransomware gang claimed the attack, reportedly demanding $2 million and threatening to leak 2.6 TB of documents.
Anne Arundel County, Maryland (population 600,000+, home to the state capital Annapolis and numerous federal agencies) disclosed on October 16, 2026 that irregular activity was discovered on its network on August 28, 2026. The county states that an unauthorized actor gained access to a limited number of systems and copied certain files; investigators are still reviewing the files to determine whether resident information is included. Federal law enforcement and other government agencies were notified. The county also noted this is separate from a prior ransomware incident (the earlier 2025 attack, attributed in reporting to a different group), for which breach-notification letters are planned for October 19, 2026.
The Rhysida ransomware-as-a-service group claimed responsibility on its Tor leak site and, per The Record, demanded $2 million and threatened to publish 2.6 TB of stolen documents. Third-party claim aggregators (hendryadrian.com, relaying the leak-site post) report 814,500 files / 2.6 TB, allegedly including medical faxes (2022-2026), 721 background-check dossiers with full SSNs in filenames, 47,602 medical-assistance files containing driver licenses, Green Cards, SSN cards, tax forms and bank data, methadone clinic records (42 CFR Part 2), payroll/HR/pension records and jail gang-intelligence files. These contents are unverified actor claims, not confirmed by the county. Aggregator dates for the leak-site post differ (October 9, 2026 per hendryadrian.com; October 12, 2026 per breachsense.com), so the exact posting date is uncertain.
No initial access vector, malware sample, or incident-specific IOC has been published for this intrusion; whether the county's systems were encrypted is not stated (the county describes file copying). Rhysida's general tradecraft is documented in CISA/FBI/MS-ISAC advisory AA23-319A (Nov 2023, updated Apr 30, 2025): valid-credential VPN access (commonly without MFA), Gootloader and exploitation of internet-facing vulnerabilities for initial access; PowerShell/cmd discovery, secretsdump/NTDS credential theft, PsExec, RDP, PuTTY/SSH and AnyDesk for lateral movement and remote access; AzCopy and Azure Storage Explorer for exfiltration; wevtutil log clearing; and a ChaCha20 / 4096-bit RSA encryptor that appends .rhysida and drops CriticalBreachDetected.pdf. Those TTPs and IOCs are actor-level references and are NOT confirmed as observed in the Anne Arundel intrusion; defenders should treat them as hunting hypotheses.
MITRE ATT&CK techniques used in TL-2026-3744
Credential Access
T1003.003 OS Credential Dumping: NTDS
Discovery
T1018 Remote System Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Privilege Escalation
T1055.002 Process Injection: Portable Executable Injection
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Impact
defense-impairment
Affected products and versions in Anne Arundel County (Maryland) Confirms August 2026 Data
- Anne Arundel County Government — County network systems and file stores (limited subset, per county)
Remediation for Anne Arundel County (Maryland) Confirms August 2026 Data
Patches
- Prioritize remediation of known exploited vulnerabilities on internet-facing systems (CISA KEV), per AA23-319A
Immediate actions
- Hunt for Rhysida TTPs from CISA AA23-319A: VPN logons with valid accounts lacking MFA, AnyDesk, PsExec, AzCopy/Azure Storage Explorer, wevtutil log clearing
- Reset credentials and enforce phishing-resistant MFA on all VPN and remote-access services
- Review egress logs for bulk transfers to cloud storage (Azure blob endpoints) consistent with multi-terabyte exfiltration
- Preserve logs and coordinate with federal law enforcement (FBI/CISA) as the county has done
Workarounds
- Block or alert on unapproved remote management tools (AnyDesk) and unapproved cloud-sync/copy utilities
- Disable or restrict legacy/unused VPN accounts
Longer-term hardening
- Segment sensitive health, HR and law-enforcement data repositories and restrict file-share access
- Remove sensitive identifiers (e.g., SSNs) from filenames and enforce data-retention limits on faxed/scanned records
- Maintain offline, immutable backups and test restoration
- Monitor for exposed employee credentials and infostealer logs and rotate affected accounts
- Application allowlisting for remote-access tools and PSTools
Timeline of Anne Arundel County (Maryland) Confirms August 2026 Data
- Rhysida ransomware group emerges, targeting education, healthcare, manufacturing, IT and government sectors (CISA AA23-319A).
- FBI, CISA and MS-ISAC publish joint #StopRansomware advisory AA23-319A on Rhysida TTPs and IOCs.
- AA23-319A updated with new Rhysida IOCs and removal of outdated indicators.
- Anne Arundel County discovers irregular activity on its network; an unauthorized actor had accessed a limited number of systems and copied certain files.
- Rhysida leak-site post for Anne Arundel County claims 814,500 files / 2.6 TB (date per hendryadrian.com; breachsense.com lists October 12, 2026).
- County publicly confirms the breach; The Record reports Rhysida's reported $2 million demand and threat to leak 2.6 TB; federal law enforcement notified.
- County plans breach-notification letters tied to the separate prior ransomware incident; review of files from the August 2026 incident for resident data continues.
Sources cited for Anne Arundel County (Maryland) Confirms August 2026 Data
- Baltimore suburb confirms August data breach after ransomware claims
- #StopRansomware: Rhysida Ransomware (AA23-319A)
- Ransom! Anne Arundel County (OCT-2026) - Rhysida claim details
- Anne Arundel County Government data breach - Breachsense
- Rhysida Ransomware Explained: TTPs, IOCs and How to Defend in 2026
- Anne Arundel County cyber incident / data breach - CBS Baltimore (earlier incident coverage)
Detection coverage for TL-2026-3744
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3744 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.