Maryland Real Property Search security outage

Analyst assessment

The Maryland Department of Information Technology detected suspicious activity April 14, 2026, on servers running the Department of Assessments and Taxation’s Real Property Search application. SDAT’s April 18 advisory said the state took the site offline to contain potential threats and investigate, and referred to the affected environment as compromised systems.

DysruptionHub assesses with high confidence that this was a confirmed cyber incident because the affected agency publicly identified suspicious server activity, security containment and compromised systems. That evidence confirms cyber involvement but does not establish a cyberattack mechanism, malicious intent, ransomware or unauthorized data access.

Operational significance

The shutdown removed statewide online access to ownership, valuation and sales information for Maryland real property. SDAT directed residents and businesses to local Real Property Assessment offices and its contact center, preserving an alternate channel but interrupting the normal self-service process. Our April 20 report documented that the tool remained unavailable nearly a week after the state detected the activity.

Maryland initially said its analysis suggested the compromised systems contained only public information already available through the application. SDAT and DoIT’s Office of Security Management later confirmed that the affected systems contained only that public information and that their analysis found no evidence of a broader compromise related to the incident.

Disclosure posture

SDAT disclosed the outage April 18, four days after detection, using cyber-specific but qualified language. The affected agency’s disclosure preceded external reporting and supports an OC-OD classification. The state did not characterize the event as ransomware, identify an actor or explain the technical nature of the server compromise.

Current status

The incident is resolved. SDAT’s April 27 advisory said security personnel thoroughly tested the Real Property website, cleared it for public use and returned the search tool online. The agency’s current online-services status page reports that all systems are operational.

Confidence and uncertainty

Confidence is high that a cyber-related security event prompted the statewide outage and that service was restored April 27 because the affected agency documented the detection, containment, testing and return to public use. Confidence is also high that investigators found no broader compromise and that the affected systems held public information, although the state did not publish detailed forensic findings.

Ransomware and threat-actor attribution remain unresolved. No stable claim of responsibility, encryption evidence, ransom demand or extortion communication was found. The attack mechanism is unknown because the public record does not identify how the servers became compromised or what activity investigators observed.

Analytic gaps

The public record does not establish the initial access vector, targeted account or host, exploited vulnerability, attacker infrastructure, malware, persistence, dwell time, system changes, unauthorized access scope, responsible actor or whether the state attributed the activity internally. It also does not provide a detailed affected-system inventory or full forensic report.