Rhysida lists Anne Arundel County with a 2.6 TB claim

The Rhysida ransomware group listed Anne Arundel County, Maryland, on its leak site on 9 October 2026, claiming 814,500 files and 2.6 TB of data that it says include background-check dossiers, Department of Health records, medical-assistance applications, payroll and pension files and detention-centre intelligence. The county, which serves about 590,000 residents around Annapolis, has not responded publicly. It disclosed a separate ransomware intrusion in February 2025 and told residents the stolen data from that incident had been recovered, so the new listing raises the question of whether Rhysida is holding old material or has been back inside the network.

Who is Rhysida?

Rhysida is a ransomware-as-a-service operation active since May 2023 that is best known for the British Library attack of October 2023 and for a string of hospitals, school districts and local governments. CISA and the FBI published a joint advisory on the group in November 2023, noting its use of external-facing remote services and phishing for initial access and its habit of auctioning stolen data for Bitcoin. The Rhysida profile on the Ransomtracker shows the group in decline by volume, with 44 listings so far in 2026 against 94 in 2025, but its targeting has not changed. This year’s entries include the city of Stuttgart, Pierce Township, Battle Creek Public Schools, Lakeside Union School District, the Cheyenne and Arapaho Tribes, the Phoenix Art Museum and General Santos Doctors Hospital in the Philippines. Public bodies with sensitive records and limited security budgets remain its preferred target.

What does Rhysida claim to hold?

The data categories described on the leak site

Rhysida’s post describes roughly 721 background-check files it says carry Social Security numbers in their filenames, including records dated 2026; tens of thousands of medical faxes from 2022 to 2026 with patient names and diagnoses; records from a methadone clinic, which in the United States fall under the special confidentiality rules of 42 CFR Part 2; 47,602 medical-assistance files it says contain identity documents, tax forms and bank details; county payroll registers, HR memoranda, contracts, pension records and a discipline database; and intelligence files from the county detention centre, including a list of alleged gang members. Ransomnews has not examined samples and reproduces none of this material. The categories are the group’s description of its own haul and should be read as a claim.

Two details stand out even as claims. The volume, 2.6 TB, is large for a county government and is consistent with file-server access rather than a single application. And the references to 2026-dated records are the detail that matters most, because the county’s only disclosed intrusion ended on 22 February 2025.

What did the county disclose in 2025?

The county’s own cyber-incident page says an external actor had unauthorised access to a limited part of its network between 28 January and 22 February 2025, that the event was later identified as a ransomware attack, and that certain files were accessed or downloaded. Its notice of May 2025 concerned people treated by the Department of Health, whose names, addresses and diagnoses may have been exposed. The same page states that “the stolen information has been recovered” and that there was no indication any of it had been published. No ransomware group was named, and Rhysida did not list the county in 2025. The page was last updated on 3 August 2026, two months before the new listing appeared.

That leaves three possibilities. Rhysida may have been the 2025 attacker and is now selling data the county believed had been contained, in which case “recovered” meant something narrower than residents assumed. Rhysida may have acquired the 2025 data from another party. Or the county has suffered a second intrusion, which the claimed 2026-dated files would suggest. Only the county can say which, and it had not done so by 15 October.

What does the stealer-log exposure show?

Rhysida’s affiliates favour exposed remote services and valid accounts, and those accounts are rarely hard to find. Stealercheck, which queries the Alerts.bar index that Ransomnews licenses, shows 73 staff-account credentials, 216 user-account credentials and 88 session cookies associated with aacounty.org in circulating infostealer logs. Those are cumulative aggregate counts, not evidence of how this intrusion happened, but 73 county employee logins in criminal circulation is a plausible starting point for any group that buys access, and it is the kind of exposure we described in stealer logs explained.

What should residents and county employees do?

Residents who used county health services, applied for medical assistance, or went through a county background check should assume their data may be in the set and act accordingly: a credit freeze with the three US bureaus, a review of medical and benefits statements for unfamiliar activity, and suspicion of any call or email that references the county. Employees should change passwords reused anywhere else and enable multi-factor authentication on personal accounts. The county’s obligations under Maryland’s breach notification law start when it determines that personal information was compromised, so a public statement, even an interim one, would do more for residents than the current silence.

What this means for local government

Counties hold the most sensitive data in the public sector, from addiction treatment to jail intelligence, and they hold it on the oldest infrastructure. A listing like this one is a test of disclosure as much as of security. “Recovered” is a word that reassures residents and means little to an operator who kept a copy, and governments should avoid it unless they can prove exclusive possession. We will update this article when the county responds, and the listing will remain on the daily digest and in the 2026 year archive until its status changes.

Frequently asked questions

Sources and further reading

• Anne Arundel County, Cyber incident information page (last updated 3 August 2026)
• CBS News Baltimore, Anne Arundel County cyber incident: ransomware confirmed, health data exposed (May 2025)
• CISA and FBI, #StopRansomware: Rhysida ransomware (advisory AA23-319A, November 2023)
• Ransomnews Ransomtracker, Rhysida operator profile, listing recorded 9 October 2026
• Related: threat-group catalogue

Reporting by the Ransomnews Research Team. Ransomnews has not viewed or downloaded the files Rhysida describes, reproduces no personal data and does not link to leak sites. Exposure figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses.