Anne Arundel County, Md., announced on Oct. 15 that it will begin notifying individuals affected by a 2025 ransomware attack while it continues to investigate a separate cybersecurity incident discovered in August 2026.
Notification letters related to the 2025 breach will start going out the week of Oct. 19, more than a year and a half after the county first detected suspicious activity on its network. The county has not disclosed how many individuals were affected by either incident.
According to the county’s press release, investigators determined that an unauthorized actor accessed portions of the county’s network between Jan. 28 and Feb. 22, 2025, and accessed or downloaded certain files without authorization.
County officials initially identified suspicious activity on Feb. 22, 2025, prompting an investigation involving cybersecurity specialists, law enforcement, and state agencies.
The county publicly disclosed the ransomware attack on May 15, 2025, and warned that personal information about people who received treatment or other services through the Anne Arundel County Department of Health may have been compromised.
At the time, officials said the potentially exposed information could include names, addresses, and medical diagnoses or conditions. The county said it had no indication that financial information was affected.
However, the county’s cyber incident webpage now identifies that a broader range of information may have been exposed. That includes Social Security numbers, birthdates, driver’s license numbers, financial account information, payment information, access credentials, biometric information, and medical records.
The county used a third party to review the compromised files, which allowed officials to identify and begin notifying individuals who may have been affected.
The county is also investigating a separate incident detected on Aug. 28, 2026. Officials discovered irregular activity affecting a limited subset of systems on its computer network.
An investigation conducted with third-party cybersecurity specialists determined that an unauthorized actor gained access to a limited number of systems and copied certain files.
The county said it immediately took steps to secure its network and notified government partners, including federal law enforcement.
County officials said they have found no evidence linking the 2026 incident to any previous cyber events or indicating that the compromised files have been used to commit identity theft or consumer fraud.
Investigators are reviewing the files involved in the 2026 incident to determine what information they contain and whether personal information was compromised. The county said it will notify affected individuals in accordance with applicable law once that review is complete.
