The Rhysida ransomware group has listed 2.6TB of data it claims to have taken from Anne Arundel County, Maryland, for sale at 25 BTC, about $2 million, and Anne Arundel County has confirmed it was attacked. The listing and the county’s confirmation were reported on October 16 and 17. The attack itself was detected on August 28, nearly seven weeks earlier.
Rhysida Advertises 814,500 Files for 25 BTC With a Seven-Day Bidding Clock
Rhysida claimed the attack and advertises 2.6TB of data, made up of 814,500 files, for 25 BTC. The listing carries a seven-day bidding clock and says the data will be sold “to one hand,” meaning to a single buyer. The group also reportedly threatened to leak the data if a $2 million ransom is not paid.
Anne Arundel County is a government of about 600,000 residents. The listing’s contents have not been verified, and the county has not said what the files include.
What the County Has Confirmed About the August 28 Attack
County officials detected suspicious activity on August 28. They have confirmed that an unauthorized actor accessed a limited number of systems and copied certain files. The contents of those files were not specified, and investigators are checking whether residents were affected.
The distance between the August attack and the October listing means the data has been in the attacker’s hands for weeks. The sale, with a bidding clock, is the stage at which stolen files may leave the attacker’s control.
A Separate Earlier Incident Complicates the County’s Notifications
The county announced on Thursday, October 15, that notification letters will go out starting the week of October 19. Those letters relate to a different, earlier cyberattack that occurred between January 28 and February 22, 2025. A county spokesperson confirmed that the August 28 attack is a separate incident.
Two Incidents, Two Sets of Residents
The two incidents have different timelines and different notification paths. Residents who receive a letter this week will be hearing about the 2025 incident, not the Rhysida listing. Residents may therefore see unrelated breach notices from the same government within weeks, and the county has not yet said whether anyone will be notified about the August attack.
Rhysida’s Pattern of Selling Municipal Data
Rhysida has listed municipal data before. It claimed a breach of Montreal-Nord, a Canadian municipality, in January 2025 and listed that data for 10 BTC. The Anne Arundel listing, priced at 25 BTC, follows the same model of listing stolen government files for sale.
What Remains Unknown
Several facts are unconfirmed: what the 814,500 files contain, whether resident information is among them, and whether the county will negotiate or pay. The county’s statement describes a limited number of systems and certain files, while Rhysida’s listing describes 2.6TB, a gap that the continuing investigation will have to resolve.
Residents of Anne Arundel County have no confirmed action to take for the August incident yet. As the investigation continues, the county’s next update will show whether resident data is involved, and the end of the seven-day bidding clock will indicate whether the files are sold or leaked.
The county has not publicly addressed whether it will pay, and Rhysida’s reported $2 million ransom demand matches the 25 BTC asking price on the listing, so both the sale and the extortion route point to the same figure. County officials said they are still investigating which systems and files were copied, and that work will determine whether residents must be notified about the August incident in addition to the 2025 one.
Anne Arundel County’s two incidents, one in early 2025 and one in August 2026, mean it is handling notifications for one attack while investigating another. The county has described the August incident as involving a limited number of systems, and a county spokesperson has confirmed the two are separate.
