Ransomware gang puts 2.6TB of sensitive Maryland government data up for sale
The Rhysida gang is now advertising the allegedly stolen data for 25 BTC, worth approximately $2 million.
Follow us
- Anne Arundel County says hackers copied files from a limited number of government systems.
- Rhysida claims it stole 2.6TB of data, including medical, payroll, banking, and jail records.
- The gang is selling the alleged data for 25 BTC, worth about $2 million.
- The county says the August attack is separate from an earlier 2025 cyberattack.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Anne Arundel County, Maryland, has confirmed that hackers stole files from its government systems during an August cyberattack. The Rhysida ransomware gang, which claimed responsibility for the attack, is now advertising 2.6TB of allegedly stolen data for sale on its dark web leak site.
On August 28th, 2026, county officials discovered suspicious activity on their government network. A spokesperson for Anne Arundel County, which has a population of roughly 600,000 people, told Recorded Future News that they then started an investigation on a “limited subset of systems within the county computer network.”
“Through the course of the county’s response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems,” the spokesperson said.
They didn’t clarify what data was involved but said the investigators are currently examining the files to determine whether the county’s residents were affected.
The Rhysida group has claimed responsibility for the attack. According to the gang, it stole 2.6TB of data, comprising 814,500 files. The data allegedly includes:
- Tens of thousands of medical faxes, including patients' names and diagnoses.
- Social Security numbers, driver's licenses, Green Cards, and banking information.
- County payroll registers, employee salaries, pension information, and disciplinary databases.
- Jail intelligence records, including information about alleged gang members.
- Methadone clinic records, which the gang claims fall under federal confidentiality protections for substance-use treatment information.
Rhysida advertises the data for 25 BTC, worth approximately $2 million at current exchange rates, saying on its site: “With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner!”
The group reportedly also threatened to leak the data if a $2 million ransom was not paid.
The county also announced on Thursday that it would soon begin notifying people potentially affected by a previous cyberattack that took place between January 28th, 2025 and February 22nd, 2025. Direct notification letters will be distributed beginning the week of October 19th, 2026.
A spokesperson confirmed that the August 28th attack is a “separate incident.”
In January 2025, Rhysida claimed to have breached the Canadian municipal government of Montréal-Nord (Montreal North), advertising allegedly stolen data for 10 BTC (roughly $1 million).
