Anne Arundel County Confirms August 28 Breach

Anne Arundel County confirmed a breach that occurred on Aug. 28, 2026, notified federal authorities, and coordinated its response with them. The county also said the incident did not disrupt its operations or essential services, and that it has found no signs so far that files tied to the episode were used for consumer fraud or identity theft.

What did the county say about the files under review?

County officials said specialists are still reviewing the files to determine whether they contain personal information. That review is part of the internal investigation that followed the confirmed unauthorized access, but so far there have been no signs of misuse for fraud or identity theft, according to the official communication cited by the sources consulted.

What did Rhysida claim after the incident?

Rhysida said it stole 2.6 TB of data spread across 814,500 files, and ZeroFox also reported an alleged sale offer for 25 BTC. The county did not verify that figure or the claimed content, and ZeroFox’s own notice said Anne Arundel County had not confirmed the specific nature of the files.

Cybernews published a similar version, saying Rhysida claimed to have taken 2.6 TB in 814,500 files. In both cases, the attribution refers to the group’s claim and not to an official confirmation from the county, which is still reviewing the files associated with the August incident.

What did officials say about a previous incident and the scope of the response?

Anne Arundel County also said it will begin sending notices during the week of Oct. 19, 2026, to people who may have been affected by a separate 2025 incident. Cybernews reported that timeline and also said a county spokesperson clarified that the Aug. 28, 2026 incident was separate from that earlier case and from the related notification process.

The Record said county officials notified federal authorities and other government agencies about the breach. That was the formal step confirmed in the official response described by the available material. The sources provided do not include a broader technical description of how the attackers got in or which systems were compromised.