Maryland’s Anne Arundel County Confirms Files Were Stolen After a Ransomware Claim: The Confirmed Facts and the Open Questions
Anne Arundel County, Md., says an intruder copied files from some county systems in August, after a ransomware gang claimed the attack and demanded $2 million. Here is what has been confirmed so far, and what is still unanswered.
Anne Arundel County, the Maryland county that includes the state capital of Annapolis, has confirmed that an intruder copied files from county government systems in an incident discovered in late August. The confirmation came after a ransomware gang publicly claimed the attack and threatened to leak the data.
This summary relies on reporting by The Record from Recorded Future News, which obtained the county’s statement.
Confirmed so far
- County staff spotted “irregular activity” on August 28 and began investigating a limited subset of systems on the county network.
- The investigation found that an unauthorized party reached a limited number of systems and copied certain files.
- Federal law enforcement and other government agencies have been notified.
- The Rhysida ransomware group claimed responsibility and threatened to release 2.6 terabytes of documents unless a $2 million ransom was paid.
- Rhysida has a long record of hitting governments, with past victims including Kuwait’s Finance Ministry, the cities of Seattle and Columbus, Ohio, and Maryland’s transportation department.
- This is separate from a ransomware attack by a different group on the same county last year. Coincidentally, the county announced on Thursday that letters about data leaked in that earlier incident will go out on October 19.
Still unanswered
- What kind of data was taken. The county did not answer that question and says investigators are still reviewing the files to determine whether any relate to residents.
- How the intruder got in, and whether any services were disrupted.
- Whether the county intends to pay, or whether any data has already been published.
- How many people, if any, will need to be notified about this second incident.
Why it matters beyond one county
Anne Arundel is home to more than 600,000 people and sits near Washington, D.C. The Record notes that dozens of federal agencies have offices there, including the Defense Department, the IRS and the Social Security Administration. A county spokesperson pointed to a surge in attacks aimed at state and local governments, and The Record lists cities and counties in New Mexico, Utah, Texas, Nebraska, Missouri and Arizona that have had cyberattack-related outages in the past two weeks.
What this means for your company
Local governments trade data with a long list of contractors, vendors and permit applicants, and stolen files often contain correspondence with those businesses. If you do work with a county or city, watch for invoice-change requests or “updated payment details” emails that appear to come from government contacts, and verify them by phone. More broadly, a gang holding 2.6 terabytes is a reminder that data theft, not just encryption, is the business model now: know where your sensitive files live, limit who can bulk-download them, and alert on large outbound transfers. Two incidents in roughly a year at the same organization is also a lesson in finishing the cleanup after the first one.
Need help assessing how exposed your business is when a public-sector partner is breached? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
