Rhysida claims to have stolen data from Anne Arundel County

• Ransomware group: Rhysida
• Country: United States
• Sector: Government & Defense
• Announcement date: October 9, 2026

Rhysida claims a massive data breach at Anne Arundel County

The ransomware group known as Rhysida has announced that it has conducted a cyberattack against Anne Arundel County. According to a post on the group's leak site, the threat actors claim to have exfiltrated a significant volume of data, totaling 2.6 TB, which they have subsequently listed on their platform for public viewing.

This announcement follows a period of time since the alleged incident occurred. While the leak was announced on October 9, 2026, the group claims that the actual attack took place on February 23, 2025. This discrepancy between the date of the attack and the date of the leak is a common occurrence in ransomware operations, where attackers may hold stolen data for months before deciding to publish it on a leak site.

Details of the alleged theft

The Rhysida group alleges that the breach resulted in the compromise of approximately 814,500 files belonging to the local government entity. These files reportedly contain a wide array of sensitive information, ranging from administrative documents to highly confidential records. The group claims that the stolen data includes information pertaining to government operations, personnel, and medical services provided by the county.

The specific types of data claimed to be involved in this breach include:

• Social security numbers (SSN)
• Medical records
• Bank data
• Tax forms
• Driver licenses
• Payroll records
• Jail intelligence files

The breadth of this alleged data theft suggests a deep penetration into various departmental systems. The inclusion of medical and personnel records highlights the sensitive nature of the information the group claims to possess.

About Anne Arundel County

Anne Arundel County is a local government entity located in the state of Maryland, United States. It is a public institution that provides various public services, administrative support, and local government operations to its residents.

Risks and implications of the breach

The exposure of such a vast amount of sensitive information carries significant risks. For the residents and employees of Anne Arundel County, the leak of social security numbers, bank data, and tax forms significantly increases the risk of identity theft and financial fraud. Furthermore, the exposure of sensitive medical data, particularly records that may be protected under regulations such as 42 CFR Part 2, could lead to significant regulatory scrutiny for the institution.

The nature of the stolen data also introduces unique security concerns. The leak of jail intelligence files could create secondary security risks for correctional staff and the facility itself. Additionally, the presence of payroll registers and HR memos indicates that internal organizational data is at risk, which can lead to reputational damage and operational disruptions.

This incident follows the pattern of double-extortion tactics frequently employed by ransomware groups like Rhysida. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the data publicly, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of confidential information.

For organizations operating within the government and defense sectors, such incidents underscore the critical importance of robust cybersecurity frameworks. Defensive measures typically include maintaining regular, offline backups, implementing strict access controls, and conducting regular security audits. Protecting sensitive medical and personnel data requires specialized attention to regulatory compliance and data encryption to mitigate the impact of potential exfiltration.

Information regarding the specific motivations or technical methods used by the Rhysida group remains limited, as is common with many ransomware-as-a-service operations.