Skip to content
DysruptionHub
Sign in Subscribe

Anne Arundel County ransomware attack

Summary

Anne Arundel County logo

Anne Arundel County detected a ransomware attack Feb. 22, 2025, after unauthorized network access beginning Jan. 28. Offices closed briefly, with internet restrictions and manual processes continuing into March. The county later confirmed affected files and announced individual privacy notices.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

  • Unauthorized access

    Unauthorized access to systems, accounts, networks, or data.

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Public safety operations disrupted

    Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Analyst assessment

A ransomware attack detected Feb. 22, 2025, disrupted Anne Arundel County government in Maryland. The county’s May 15 notice confirmed unauthorized access to part of its network from Jan. 28 through Feb. 22 and said certain files were accessed or downloaded without authorization. The access window precedes the documented service disruption.

County buildings closed to the public Feb. 24 and reopened Feb. 25 with some services limited. Recovery continued afterward. The county later reported that operations had returned to normal, supporting a resolved status without an exact restoration date.

Operational significance

The closure notice described restricted internet access and remote work for eligible employees. Two aging and disabilities customer-service centers, tax-preparation services, recycling centers and the landfill closed, while parks, senior activity centers and curbside collections continued. Schools and public libraries were unaffected.

The county’s initial public notice said 911 and 311 remained operational. Local reporting described unavailable computer-aided dispatch tools affecting call management and documentation, while emergency dispatch continued. Those distinctions matter: the evidence does not establish an interruption of emergency call-taking or the dispatch of responders.

The Feb. 25 reopening announcement warned that some services remained limited. Subsequent updates described temporary manual processes and alternative bill-payment methods. On March 14, the county restored onsite employees’ internet access for certain business processes while continuing recovery work. A May 15 statement reported normal operations and no continuing service disruption.

Confidence and uncertainty

Confidence is high in the ransomware finding, network intrusion and documented service interruption because the county confirmed them. The May notice initially identified possible exposure of names, addresses and medical diagnoses or conditions associated with Department of Health services. The county’s updated incident page, revised in October 2026, listed a broader range of potentially involved identity, financial, credential, biometric and medical information, varying by individual.

An Oct. 15, 2026, update said the file review was complete and announced individual letters beginning the week of Oct. 19. That announcement does not establish how many people ultimately received letters or that every listed information category affected every person.

Early local reporting attributed the attack to INC and described messages alleging a large data release. The reviewed county findings do not confirm that actor or alleged release. A separate August 2026 intrusion and the later Rhysida claim concern another event and are excluded from this incident’s attribution and data-volume assessment.

Analytic gaps

The initial access method, verified affected-person count, complete file-acquisition scope, ransom demand and payment history remain unverified. The May 1 budget address proposed a $4.3 million increase in broader IT spending; it did not identify that figure as this attack’s response cost or a ransom payment. The precise date of complete restoration is unknown. March 14 documents a recovery milestone, and May 15 confirms normal operations.

Threat actor and claim

INC Ransom

Listed as: Anne Arundel CountySource: other

Claim details

Eye On Annapolis attributed the February 2025 incident to INC in an undated update to its Feb. 22 report. The outlet also reported messages received in the county alleging that terabytes of data had been released on a site called incblog. These are secondary allegations; the reviewed evidence does not independently verify an actor-controlled victim listing, INC’s responsibility or a public data release. The county’s May 15 findings confirmed ransomware and unauthorized access from Jan. 28 through Feb. 22, but did not name INC. The current county incident page reports no indication of public release. The original claim’s publication and discovery dates remain unverified. Current tracker searches return a Rhysida claim from October 2026 concerning a separate incident; that claim does not substantiate this 2025 attribution. No ransom demand or payment has been verified.

Organizations involved

Impacted locations

  • Annapolis, Maryland

    Annapolis is preserved as the physical city anchor for county administration and the affected county buildings and workflows. The county’s geographic service area is represented separately. This relationship concerns the county government; it does not identify a separate attack on Annapolis city government.

  • Anne Arundel County, Maryland

    The county is the geographic remit of the directly affected county government, paired with its existing organization service area. Official notices document building closures, limited services and manual workarounds. Emergency and essential services continued, while schools and public libraries were unaffected. This area does not imply that every resident or service experienced an outage.

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.