# Anne Arundel County (Maryland) Confirms August 2026 Data Breach After Rhysida Ransomware Claims

> Anne Arundel County, Maryland confirmed that an unauthorized actor accessed a limited number of county systems and copied files after irregular activity was discovered on August 28, 2026. The Rhysida ransomware gang claimed the attack, reportedly demanding $2 million and threatening to leak 2.6 TB of documents.

- **Published:** 2026-10-16T13:27:28Z
- **Last reviewed:** 2026-10-16T13:27:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3744
- **ID:** TL-2026-3744
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Rhysida
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Anne Arundel County, Maryland (population 600,000+, home to the state capital Annapolis and numerous federal agencies) disclosed on October 16, 2026 that irregular activity was discovered on its network on August 28, 2026. The county states that an unauthorized actor gained access to a limited number of systems and copied certain files; investigators are still reviewing the files to determine whether resident information is included. Federal law enforcement and other government agencies were notified. The county also noted this is separate from a prior ransomware incident (the earlier 2025 attack, attributed in reporting to a different group), for which breach-notification letters are planned for October 19, 2026.

The Rhysida ransomware-as-a-service group claimed responsibility on its Tor leak site and, per The Record, demanded $2 million and threatened to publish 2.6 TB of stolen documents. Third-party claim aggregators (hendryadrian.com, relaying the leak-site post) report 814,500 files / 2.6 TB, allegedly including medical faxes (2022-2026), 721 background-check dossiers with full SSNs in filenames, 47,602 medical-assistance files containing driver licenses, Green Cards, SSN cards, tax forms and bank data, methadone clinic records (42 CFR Part 2), payroll/HR/pension records and jail gang-intelligence files. These contents are unverified actor claims, not confirmed by the county. Aggregator dates for the leak-site post differ (October 9, 2026 per hendryadrian.com; October 12, 2026 per breachsense.com), so the exact posting date is uncertain.

No initial access vector, malware sample, or incident-specific IOC has been published for this intrusion; whether the county's systems were encrypted is not stated (the county describes file copying). Rhysida's general tradecraft is documented in CISA/FBI/MS-ISAC advisory AA23-319A (Nov 2023, updated Apr 30, 2025): valid-credential VPN access (commonly without MFA), Gootloader and exploitation of internet-facing vulnerabilities for initial access; PowerShell/cmd discovery, secretsdump/NTDS credential theft, PsExec, RDP, PuTTY/SSH and AnyDesk for lateral movement and remote access; AzCopy and Azure Storage Explorer for exfiltration; wevtutil log clearing; and a ChaCha20 / 4096-bit RSA encryptor that appends .rhysida and drops CriticalBreachDetected.pdf. Those TTPs and IOCs are actor-level references and are NOT confirmed as observed in the Anne Arundel intrusion; defenders should treat them as hunting hypotheses.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1055.002 Process Injection: Portable Executable Injection
- T1685.005 Clear Windows Event Logs
- T1003.003 OS Credential Dumping: NTDS
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1087.002 Account Discovery: Domain Account
- T1069.002 Permission Groups Discovery: Domain Groups
- T1021.001 Remote Services: Remote Desktop Protocol
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1657 Financial Theft

## Sources

- [Baltimore suburb confirms August data breach after ransomware claims](https://therecord.media/anne-arundel-county-maryland-confirms-data-breach)
- [#StopRansomware: Rhysida Ransomware (AA23-319A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)
- [Ransom! Anne Arundel County (OCT-2026) - Rhysida claim details](https://www.hendryadrian.com/?p=115473)
- [Anne Arundel County Government data breach - Breachsense](https://www.breachsense.com/breaches/anne-arundel-county-government-data-breach/)
- [Rhysida Ransomware Explained: TTPs, IOCs and How to Defend in 2026](https://cybelangel.com/blog/rhysida-ransomware-explained-ttps-iocs-and-how-to-defend-in-2026/)
- [Anne Arundel County cyber incident / data breach - CBS Baltimore (earlier incident coverage)](https://www.cbsnews.com/baltimore/news/anne-arundel-county-cyber-incident-data-breach)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3744