Anne Arundel County: Rhysida Ransomware Claims 2.6 TB Data Theft

On 9 October 2026, the Rhysida ransomware group added Anne Arundel County, Maryland, to its dark web leak site. The listing says the group took about 2.6 TB of data across 814,500 files. It describes Social Security numbers, medical and addiction-treatment records, payroll data and jail gang-intelligence files. The county has not publicly confirmed an intrusion, and no primary source (no county statement, regulator filing or CERT advisory) is available. Treat this as a claim until the county confirms it. Every figure below comes from the gang's own listing, as reported by third-party leak-site trackers.

What Happened

HookPhish and QPulse both report that the listing appeared on 2026-10-09, with discovery logged at 19:38 UTC. QPulse also gives 9 October as the estimated attack date. In practice, that date usually reflects when the listing was posted, not when the intrusion happened. Security Arsenal says Anne Arundel County was one of three US organisations Rhysida posted between 9 and 10 October. The other two were Gress Clark Young & Schoepper and RealManage. Security Arsenal also notes that a second leak-site crawler independently saw all three listings. That corroboration confirms only that the gang published the claim. It does not confirm that a breach happened.

Separate incident nearby. In September 2026, Luminis Health, which operates Anne Arundel Medical Center, had a cyberattack. Local station WBAL reported cancelled cancer treatments, rerouted patients and delayed imaging results, with disruption starting around 31 August. Luminis said on 8 October that its systems had been restored and that its investigation is still ongoing. Luminis Health is a private health system, not part of the county government. None of the sources attribute the Luminis attack to Rhysida, and none link it to the county listing. Defenders should not merge the two incidents. The overlap in geography and medical data is worth watching, but it is not evidence of a connection.

What Was Taken

According to the leak-site listing (reported identically by HookPhish and QPulse), the data includes:

• Volume: 814,500 files, about 2.6 TB
• Background checks: 721 dossiers, with full SSNs in the filenames and records from as recent as 2026
• Medical faxes: "tens of thousands" dated 2022 to 2026, containing patient names and diagnoses
• Substance-use treatment: methadone clinic records covered by 42 CFR Part 2, the strictest federal confidentiality rules for this kind of record
• Medical assistance: 47,602 files containing driver's licences, Green Cards, SSN cards, tax forms and bank data
• Personnel: county payroll registers with all salaries, plus HR memos, contracts, and pension and discipline databases
• Law enforcement: jail gang-intelligence files, including a master list of gang members

The two trackers report the same counts, but both rely on the gang's description. No independent party has verified them. Ransomware groups sometimes inflate their claims to put pressure on victims.

Why It Matters

If the claim is accurate, this would be one of the most sensitive local-government data exposures of the year. It would hit residents, employees and people held in the county's custody. Three categories stand out:

• 42 CFR Part 2 records: exposure of addiction-treatment records has legal consequences and puts patients at risk of stigma or discrimination.
• Gang-intelligence lists: these create physical safety risks for people named in them and for informants. The risk goes well beyond identity theft.
• Identity documents for medical-assistance recipients: SSN cards, Green Cards and bank data together are enough for full identity theft. They also put people who receive public assistance, and immigrants, at risk of targeted fraud.

Security Arsenal says the listing fits Rhysida's usual targets: mid-market organisations and local governments that hold sensitive data on limited security budgets. Proven Data and AS IT Tech both list government among the group's main sectors, along with healthcare and education.

The Attack Technique

The sources do not say how anyone got into the county's network. What is known about Rhysida comes from its past activity:

• Initial access: Proven Data and AS IT Tech both point to valid or compromised credentials used against VPNs that lack MFA. Proven Data also mentions fake signed installers and "TerminalFix" lures. Security Arsenal tells organisations running VMware vCenter, Check Point gateways, Cisco FMC or JetBrains TeamCity to check their detection coverage.
• Lateral movement: AS IT Tech says the group uses Cobalt Strike.
• Encryption: accounts differ. Proven Data describes AES-256-CTR with RSA-4096 for the Windows encryptor. AS IT Tech describes ChaCha20 with RSA-4096. Both agree that files are only partly encrypted and given a .rhysida extension. Proven Data names the ransom note CriticalBreachDetected.pdf.
• Platforms and lineage: the group targets Windows, Linux and VMware ESXi. Proven Data links it to the cluster behind Vice Society (Vanilla Tempest / GOLD VICTOR).
• Operating model: accounts differ here too. AS IT Tech calls it ransomware-as-a-service. Proven Data says it is disputed whether it is RaaS or a private operation.
• Advisory and decryption: AS IT Tech cites the CISA/FBI joint advisory AA23-319A. Proven Data says the public decryptor works only on early Windows builds. It does not work on builds first seen in June 2024 or later, or on the Linux/ESXi and PowerShell variants.

What Organizations Should Do

1. Require MFA on all remote access. That includes VPN, RDP gateways and admin consoles. Search VPN logs for logins from unusual locations or at unusual times, since stolen credentials are Rhysida's documented way in.
2. Patch and monitor edge and management systems. Prioritise vCenter, Check Point, Cisco FMC and TeamCity, and confirm detections cover Cobalt Strike beacons and the creation of ESXi-targeting payloads.
3. Watch for large outbound transfers. A theft of 2.6 TB should produce visible egress. Set baselines for outbound traffic from file servers and document-management systems, and alert on spikes to cloud storage or unfamiliar hosts.
4. Split up regulated data. Store 42 CFR Part 2, HIPAA, law-enforcement and HR data in separate locations with tight access controls and audit logs. Avoid putting identifiers such as SSNs in filenames.
5. Preserve evidence before rebuilding. If you find Rhysida activity, collect forensic images first. They are what show the scope of data theft for notification. Identify the encryptor build before relying on any decryptor.
6. Prepare for scams that piggyback on the incident. If the county or nearby organisations are affected, expect phishing that pretends to come from the county or from Luminis. Warn staff and residents not to give out personal or login details in response to unexpected contact.

Sources: Ransomware Group rhysida Hits: Anne Arundel County | Rhysida Ransomware Group Exfiltrates 2.6 TB of Data from Anne Arund... | RHYSIDA Ransomware Gang: 3 New Leak-Site Claims — US Professional S... | Luminis Health Cybersecurity Incident Update | Anne Arundel Medical Center cyberattack delays patient care - WBAL | Luminus Health cyberattack disrupts Anne Arundel Medical Center - WBAL | Rhysida Ransomware: Attack Chain, IOCs, and Recovery Options | Rhysida Ransomware Recovery: What's Recoverable AS