Rhysida’s 2.6TB Maryland County Data Sale: What We Know

WarBrief Live | October 18, 2026 | Intelligence Reports

* Figures with an asterisk are claimed by the ransomware group and have not been verified by the county or any independent party.

Anne Arundel County, Maryland — home to the state capital, Annapolis, and roughly 600,000 residents — has confirmed that hackers copied files from its government networks during a cyberattack discovered on August 28, 2026. Days after the county went public, the Rhysida ransomware gang claimed responsibility and began advertising what it says is 2.6 terabytes of stolen county data for sale at 25 bitcoin, described in reporting as worth about $2 million. The county has confirmed the theft occurred but has not verified the gang’s claims about what was taken.

The case is a textbook study in modern double extortion: a local government that admits files were copied, a criminal group that publishes an inventory of the alleged loot, and a long gap in which residents cannot know whether their personal information is part of the stockpile. Here is what is confirmed, what is merely claimed, and what happens next.

What happened in Anne Arundel County?

On August 28, 2026, Anne Arundel County officials say they “detected irregular activity” on systems within the county’s computer network and launched an investigation. That investigation established that an unauthorized actor gained access to a limited number of systems and copied files from them, according to a news release from the office of County Executive Steuart Pittman. Spokesperson Gabby Reed declined to provide further detail, citing the ongoing investigation.

The disclosure came on October 15, 2026 — roughly seven weeks after the intrusion was detected — reported The Banner, Maryland’s regional daily. The county’s statement emphasized three reassurances: the attack did not interfere with any county operations, no impact on essential services is anticipated, and there is “no indication” the files have been used for fraud or identity theft. The county said it notified federal law enforcement and is coordinating its response.

The ransomware angle emerged from ransomware.live, an open-source tracker of ransomware leak sites, which reported on October 9, 2026 that Anne Arundel County had been listed as a victim by Rhysida. (One aggregator dates the listing to October 12, so the exact posting date is uncertain.) Cybernews, citing Recorded Future News, reported that a county spokesperson acknowledged the investigation into “a limited subset of systems” while the gang posted its demands.

Context matters: on September 2, a separate cyberattack was reported at Luminis Health, which operates the Anne Arundel Medical Center in Annapolis; the health system said all its systems were back online on October 9, according to The Banner. The county says its August incident is unrelated to “any previous cyber event” — a point that also covers the earlier 2025 county breach.

Who is Rhysida, and how does its ransomware work?

Rhysida is a ransomware-as-a-service (RaaS) operation that has been active since at least May 2023. In a joint advisory, the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC) described Rhysida as a group that “predominantly” targets government, education, healthcare, manufacturing and technology organizations — a profile that fits a county government exactly. The advisory is tracked as AA23-319a and was most recently revised in April 2025.

The group’s signature is double extortion: victims are pressured to pay once to regain access to encrypted systems and again to stop the group from publishing stolen data. Rhysida’s toolkit, as documented by CISA, includes breaching external-facing remote services such as VPNs with stolen credentials, “living off the land” techniques that use legitimate system tools to blend in, and exfiltration with standard utilities before any encryption begins. Affiliates have been observed using phishing, Cobalt Strike, PsExec, RDP and AnyDesk, according to threat researchers.

Rhysida’s claimed victim list includes the cities of Seattle and Columbus, Ohio, and Kuwait’s Ministry of Finance, per reporting by Recorded Future News. Like many RaaS groups, it runs a Tor-based leak site where it posts victim names, data inventories and countdown timers to pressure payment. Its ransom notes — dropped as a PDF file named “CriticalBreachDetected” — present themselves as an “alert” from the gang’s own “cybersecurity team” and direct victims to the leak portal.

The group sits in the same threat ecosystem WarBrief has covered before: the n0n extortion crew used a similar leak-and-sell pressure model against dozens of shipping firms, and Microsoft’s takedown of billion-message phishing infrastructure targeted the delivery pipelines groups like Rhysida depend on. See our Intelligence Reports hub for ongoing coverage of state and criminal cyber operations.

What the gang claims it stole — and what the county confirms

This is the part of the story where confirmed fact and criminal marketing diverge. The county has confirmed only that an unauthorized actor copied files from a limited number of systems; it has not said what the files contain, how many there are, or whether residents’ data is involved. Everything in the gang’s inventory below is a reported, unverified claim — the county has not confirmed it, and no independent party has verified it either.

Rhysida claims the haul totals about 2.6 terabytes across roughly 814,500 files, and is offering it for 25 bitcoin — described in reporting as worth approximately $2 million. The alleged inventory includes tens of thousands of medical faxes (2022–2026) with patient names and diagnoses, background-check dossiers containing full Social Security numbers, medical-assistance files with driver’s licenses, Green Cards, SSN cards, tax forms and bank data, county payroll registers and HR databases, and jail gang-intelligence records. If even part of that inventory is real, the breach would expose residents, county employees and people in the county’s detention system.

Confirmed figures come from the county’s official statements and regional reporting; reported figures are Rhysida’s own claims, which no independent party has verified.

Why a county-government hack matters nationally

Anne Arundel is not an outlier — it is a pattern. US county governments combine exactly the attributes ransomware affiliates prize: they hold residents’ most sensitive data (tax, health, law-enforcement and payroll records), they run small security teams on tight budgets, and they cannot simply go dark, because essential services must keep running. The county’s statement that operations were unaffected is reassuring, but it says nothing about the data — and in double-extortion cases, the data is the entire point.

The federal angle matters too. Anne Arundel County sits inside the Washington-Baltimore corridor, dense with federal agencies and contractors; a breach of county systems can expose personnel who hold federal clearances, as payroll and HR records are exactly the files Rhysida claims to hold. The county has notified federal law enforcement, and investigators will be mapping whether any of the copied material touches federal equities.

There is also the compounding problem: the county is now managing two breaches at once. The 2025 incident — an intrusion window stretching from January 28 to February 22, 2025 — is only now reaching the notification stage, with letters to potentially affected individuals scheduled for the week of October 19, 2026, per the county’s data-privacy notice. Residents may receive notices about two separate breaches weeks apart, which is a communications challenge and a trust problem.

What the Anne Arundel breach means for US/UK/EU readers

US readers: if you live, work, or pay property tax in Anne Arundel County, the practical guidance is simple — wait for the county’s official notification, then treat any letter as a trigger to review credit reports, consider a credit freeze, and watch for phishing that references county services. Do not trust unsolicited “breach assistance” calls or emails. The case is also a reminder that your data’s security is only as strong as the weakest government database it sits in — the same ransomware playbook works against school districts, water utilities and hospitals across all fifty states.

UK and EU readers: the Rhysida playbook is not American-only. The group has targeted European organizations, and the same double-extortion model is used against councils and NHS trusts in Britain and municipal administrations across the EU. Under GDPR and UK data-protection law, public bodies face a 72-hour notification duty to regulators — a far tighter clock than the seven weeks Anne Arundel took to go public — but the underlying incident-response problem (forensics before disclosure, verify before naming victims) is identical everywhere.

For everyone: ransomware economics depend on silence and delay. Every week a breach stays undisclosed is a week the stolen data circulates; every unpatched VPN is an invitation. The CISA/FBI/MS-ISAC advisory recommends phishing-resistant multi-factor authentication on all external services, offline immutable backups, and treating the first response hour as a crime scene — not a cleanup job.

Different perspectives

The county’s posture — confirm the minimum, withhold the rest pending investigation — is standard incident-response doctrine: premature claims about what was taken can mislead residents and tip off the attacker. Critics counter that seven weeks between detection and disclosure is a long time for residents’ Social Security numbers to sit on a criminal marketplace, and that the “no indication of fraud” line, while technically true, is cold comfort when the gang is literally advertising the data.

Cybersecurity researchers note a second tension: the gang’s inventory may be inflated or partly fabricated to pressure payment, but it may also understate the truth. Ransomware.live and other trackers explicitly index only what the groups publish, without accessing the underlying data — so the public record of this breach will remain unverified until the county completes its review or the data appears in the wild. Until then, skepticism cuts both ways: do not assume the gang has 2.6 TB, and do not assume the county lost nothing sensitive.

What to watch next in the Anne Arundel case

• The ransom clock: Rhysida sets sale or leak deadlines on its portal. Whether the county pays, ignores, or negotiates — none of which officials have commented on — will determine whether the data is sold privately or dumped publicly.
• The county’s file review: officials say they are reviewing the copied files to determine whether residents’ information is involved. That review, and the notification that follows, is the single most important milestone for the ~600,000 people the county serves.
• The 2025 notifications: letters for the earlier breach begin going out the week of October 19, 2026. Watch for what categories of data the county names — it will signal how seriously the 2026 investigation is being resourced.
• Federal involvement: the county notified federal law enforcement. Any indictments, seizures or infrastructure takedowns tied to Rhysida’s Anne Arundel operation would likely surface through the FBI or CISA.
• Copycat targeting: every public county-government breach advertises the sector’s softness. Expect other Maryland and mid-Atlantic local governments to harden remote access in the coming weeks — or to appear on the next leak-site list.

Frequently asked questions

What is Rhysida ransomware?
Rhysida is a ransomware-as-a-service group active since May 2023. It encrypts victims’ systems and steals data first, then uses the threat of publishing the stolen data to extort payment — a tactic known as double extortion. CISA, the FBI and the MS-ISAC issued a joint advisory on the group (AA23-319a) because it disproportionately targets government, education, healthcare and manufacturing organizations.

Is the August 2026 attack connected to the 2025 Anne Arundel breach?
No. The county says there is “no indication” the August 2026 intrusion is related to any previous cyber event. The earlier incident involved an intrusion window from January 28 to February 22, 2025, and breach-notification letters for it were scheduled to begin going out the week of October 19, 2026.

Did Anne Arundel County pay the ransom?
The county has not said. Officials have not commented on any ransom demand, payment, or negotiation. The gang’s public listing offers the data for 25 bitcoin, described in reporting as worth about $2 million.

Was my personal data stolen in the breach?
That is still unknown. The county confirmed files were copied but has not confirmed their contents. Officials say they are reviewing the files and will notify affected individuals based on the review. If you are a county resident or employee, wait for official county communication and be wary of unsolicited “breach help” messages.

How long did it take the county to disclose the attack?
The intrusion was detected on August 28, 2026, and the county’s public statement came on October 15, 2026 — about seven weeks later. The county cited an ongoing investigation and did not explain the timeline beyond that.

Sources

• The Banner: Anne Arundel County hit by cyberattack in late August
• Cybernews: Maryland government data stolen by ransomware gang put up for sale
• Abijita: Rhysida Ransomware Gang Claims Theft of 2.6TB of Data From Maryland County
• Ransomware.live: Victim listing — Anne Arundel County / Rhysida
• CISA/FBI/MS-ISAC: #StopRansomware — Rhysida Ransomware (AA23-319a)