Rhysida Claims 2.6TB Theft from Anne Arundel Systems on August 28

County investigators traced irregular activity to copied files on a narrow network segment. Officials notified federal agencies including components of the Defense Department and IRS located inside county borders. No data types have been classified yet, and breach letters for the separate 2023 incident are scheduled for October 19. The two events demonstrate repeated targeting of the same Maryland jurisdiction within 12 months.

Rhysida has previously hit Seattle, Columbus, and Maryland’s own transportation department. Procurement records show Anne Arundel’s 2023 recovery relied on external IR firms without published post-incident hardening metrics. Current surge data from New Mexico, Texas, and Arizona counties indicates attackers are prioritizing jurisdictions with federal agency density and aging Windows domains.

The county’s proximity to Annapolis and multiple DoD facilities increases the value of any personnel or contract files. Independent monitoring of Rhysida leak sites shows the group’s average time-to-leak after non-payment has shortened to 11 days. Public disclosure timing suggests the county is still mapping data ownership rather than preparing for imminent publication.

Next steps center on whether the limited-scope finding holds once full disk images are reviewed and whether federal partners issue a joint advisory.