Baltimore suburb confirms August data breach after ransomware claims

Officials in Anne Arundel County, Maryland, confirmed that hackers stole files from government systems during an incident in August. 

A county spokesperson told Recorded Future News that they discovered “irregular activity” on August 28 and began an investigation on a “limited subset of systems within the county computer network.”

“Through the course of the county’s response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems,” the spokesperson said. 

The spokesperson did not respond to questions about what data was involved but said investigators are currently reviewing the files to determine whether any stolen information related to residents of the county. 

The Baltimore suburb is home to more than 600,000 residents and the state’s capital of Annapolis. Washington, D.C. is nearby, as well. Dozens of federal agencies have offices or headquarters in the county, including the Defense Department, the Internal Revenue Service, the Environmental Protection Agency, the Social Security Administration, the Department of Agriculture, the U.S. Coast Guard and more. 

County officials said they notified federal law enforcement about the data breach as well as other government agencies. 

The attack was claimed by the Rhysida ransomware gang, which threatened to leak 2.6 terabytes worth of documents stolen from the county if a $2 million ransom was not paid. 

The group recently attempted to extort the government of Berlin after stealing troves of emails and contracts from government systems. 

Rhysida has repeatedly targeted governments across the globe since emerging several years ago. Its victims include Kuwait’s Finance Ministry, the city of Seattle and the city of Columbus, Ohio and even the transportation department of Maryland.

Anne Arundel County dealt with a ransomware attack by a different group last year that forced the government to shut off multiple systems.

In a stroke of bad luck, the county released a new statement about last year’s attack on Thursday evening, telling residents that it planned to send out breach notification letters about leaked data in that incident on October 19. 

A spokesperson for the county told Recorded Future News that the August 28 attack is a “separate incident.”

The Anne Arundel County spokesperson added that recent reports “indicate that there has been a surge in these kinds of calculated cybercrimes specifically targeting state and local governments.” 

Cities and counties in New Mexico, Utah, Texas, Nebraska, Missouri and Arizona have all dealt with service outages over the last two weeks due to cyberattacks.