Anne Arundel County confirms file theft in August cyberattack
Anne Arundel County, Maryland, has confirmed that an intruder copied files from government computer systems in an August cyberattack, while investigators are still determining whether residents’ personal information was involved. The county disclosed the file theft in an October 15 statement, followed by reporting from The Record on October 16 and an updated official information page that day. The disclosure establishes a privacy risk even though officials say essential services were not disrupted.
For residents, the immediate difficulty is knowing which incident a warning concerns. The county is also preparing notification letters about a separate 2025 breach. Those letters are due to begin going out the week of October 19, 2026; they are not notification of the August 2026 attack.
The county’s official incident information page, marked as updated October 16, distinguishes the two events. That distinction matters before anyone assumes a particular type of personal information was taken in the newer intrusion.
What officials have confirmed about the August attack
A county spokesperson told The Record that officials discovered irregular activity on August 28, 2026, and investigated a limited subset of systems on the county network.
“Through the course of the county’s response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems,” the spokesperson said, according to the publication.
The county’s public statement says it took immediate action to secure the network and establish the activity’s scope and source. It says the incident did not interfere with operations and that no impact to essential services is anticipated.
Those operational assurances do not resolve the privacy question. A network can continue functioning even when files have been copied without permission. The outstanding issue is what those files contained, not simply whether residents could still use county services.
The spokesperson told The Record that investigators were reviewing the files to establish whether stolen information related to residents. In its October 15 statement, the county said there was then no indication of consumer fraud or identity theft involving those files, and that it would notify affected individuals as required by law once the review established the relevant details. Officials also said they notified federal law enforcement and other government agencies.
The ransomware claim is not a verified account of the losses
The Record reported that the Rhysida ransomware group claimed responsibility and threatened to publish 2.6 terabytes of documents unless it received $2 million. Those figures are the attackers’ claims, not a county-confirmed measurement of stolen data or a verified ransom demand acknowledged by officials.
On its incident page, the county says it is aware of a cybercriminal group’s dark-web claims but will not confirm or comment publicly on the data the group says it stole. Its stated priority is reviewing the files to determine their contents, whether they relate to individuals, and what information is associated with those people.
The sources reviewed for this article do not establish how many people were affected by the August incident, which categories of personal information were involved, or how the intruder gained access. They also do not establish that the county paid a ransom. Residents should not interpret a criminal group’s description of its haul as an official breach notice.
Why the October letters concern a different breach
The county’s incident page separately describes unauthorized access between January 28 and February 22, 2025. Officials discovered suspicious activity on February 22 that year and issued a preliminary public notice on May 15, 2025.
The county says a third-party review of files from that earlier event has been completed, allowing direct notification letters to begin the week of October 19, 2026.
For the 2025 event, the notice lists potentially involved information ranging from names and identification numbers to financial, insurance and medical information. It stresses that the information varies by individual. Those categories must not be transferred to the August 2026 case: the public review of that newer incident has not established the same details.
Anyone receiving a letter should check the incident dates and the specific information described as involved, rather than assuming every item in the county’s general notice applies to them.
What residents can do while the review continues
Start with the county’s official incident page, reached by typing aacounty.org into a browser and navigating to its cyber-incident information. It provides updates and contact details without requiring residents to follow an unsolicited message claiming to offer breach assistance.
Treat unexpected calls, emails or texts about compensation, identity verification or urgent account action cautiously. Verify the sender using independently obtained contact information before sharing personal details. A genuine public disclosure can give impersonators a convincing reason to contact people, even when the scope of the underlying breach remains uncertain.
The county recommends reviewing account statements, credit reports and insurance explanations of benefits for unfamiliar activity, and reporting suspicious transactions to the relevant institution. Its notice also explains fraud alerts and credit freezes. A freeze restricts access to a credit report to help prevent new credit being opened without consent; it does not stop misuse of an existing bank account or resolve every form of identity fraud.
For now, the most useful distinction is straightforward: file theft in the August 2026 intrusion is confirmed through the county’s statement to The Record, but the personal-data impact remains under review. The imminent notification letters concern the separate 2025 incident. Residents need the findings for the correct event before they can judge their own exposure.