Anne Arundel County

Summary

Anne Arundel County officials are investigating two separate cybersecurity incidents involving unauthorized network access and file copying. In one incident, an intruder accessed systems over a period spanning several weeks and potentially exposed varying types of personal information, prompting notification letters to affected individuals. In a separate incident, unauthorized access to a limited number of systems resulted in copied files without disrupting operations or essential services. Investigators have found no evidence linking the incidents, no indication of consumer fraud or identity theft from the copied files, and cybersecurity specialists are reviewing the data to determine whether personal information was affected.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Anne Arundel County officials first noticed suspicious activity on the county's computer network in February 2025. An investigation determined that someone gained unauthorized access to county systems between January 28 and February 22, 2025. The types of information potentially accessed varied by individual. The county announced it would begin sending notification letters to people whose information may have been affected by that 2025 cyber attack. Officials urged affected individuals to review account statements, credit reports, and explanations of benefits for unusual activity or errors. They also directed people to report suspicious activity to the appropriate healthcare provider, insurer, and bank. The notification effort was underway even as the county addressed a separate security event.

In a separate incident, the county detected irregular activity on a limited number of systems on August 28. Investigators determined that someone gained unauthorized access to those systems and copied certain files. The August incident did not disrupt county operations, and officials stated they did not expect any impact on essential services. The county said it found no indication that files from the August incident had been used to commit consumer fraud or identity theft. Officials also found no indication that the August incident was related to any previous cybersecurity incident. Cybersecurity specialists are reviewing the copied files to determine what information they contain and whether anyone's personal information was affected.

Sources

Sources available to members: 1 source.