Anne Arundel County Confirms Unauthorized Access to Government Systems in Two Cybersecurity Incidents, Announces Plans to Notify Affected Individuals

Anne Arundel County officials have released new information concerning two cybersecurity incidents involving unauthorized access to government computer systems in 2025 and 2026, confirming that certain files were accessed or copied and that notification letters will soon be sent to individuals potentially affected by the earlier incident.

In an October 15, 2026, announcement, county officials provided updates on both incidents, outlining the findings of cybersecurity investigations, efforts to identify potentially compromised information and measures being taken to notify affected individuals.

Related: Anne Arundel County CyberSecurity Incidents

The first incident was discovered on February 22, 2025, when county officials identified suspicious activity involving portions of the county's computer network.

An investigation conducted with assistance from cybersecurity specialists, law enforcement and state agencies subsequently determined that an unauthorized party had accessed a limited portion of the network between January 28 and February 22, 2025.

During that period, certain files were accessed or downloaded without authorization.

The county issued an initial public notice on May 15, 2025, alerting individuals who may have been affected. An extensive third-party examination of the files was subsequently conducted to identify the information involved and determine whose personal information may have been compromised.

According to county officials, that review was recently completed, and notification letters are scheduled to begin being distributed during the week of October 19, 2026.

The county indicated that the types of information potentially involved differ among individuals. The announcement did not specify the total number of people affected or provide a detailed breakdown of the personal information involved.

Second Cybersecurity Incident Discovered in August 2026

County officials also disclosed additional findings concerning a separate cybersecurity incident detected on August 28, 2026.

During that incident, irregular activity was identified within a limited number of county computer systems, prompting immediate security measures and an investigation involving outside cybersecurity specialists.

Investigators determined that an unauthorized individual or group gained access to several systems and copied certain files.

Despite the unauthorized activity, county officials reported that government operations were not disrupted and that no interruption to essential services is anticipated.

The county also emphasized that investigators have found no indication that information involved in the August incident has been used for consumer fraud or identity theft.

Additionally, officials reported no evidence at this time suggesting that the August 2026 incident was connected to any previous cybersecurity event.

A review of the files involved in the August incident is underway to determine their contents, whether they contain information relating to identifiable individuals and whether additional notifications will be required.

County officials said individuals determined to have been affected will be notified in accordance with applicable law.

The county has also notified government partners, including federal law enforcement authorities, and is coordinating its response with those agencies.

Councilman Nathan Volke Raises Questions About Transparency, Notification Delays and Cybersecurity Spending

Anne Arundel County Councilman Nathan Volke has sharply criticized the county administration's handling of the cybersecurity incidents, raising questions about delayed public notification, the apparent lack of communication with elected officials and the effectiveness of increased spending on information technology security.

In a statement addressing the August 2026 incident, Mr. Volke questioned why the public was not informed until October 15, approximately seven weeks after county officials first detected unauthorized activity.

"The County Council, the body that funds the county's cybersecurity, got no email, no briefing, and no call."

The councilman also expressed concerns about the county's handling of the previous cybersecurity incident, noting that individuals whose information was potentially compromised in 2025 are only now beginning to receive direct notification letters. He further asserted that the administration took nearly three months to acknowledge that residents' health information had been taken during the earlier incident.

Mr. Volke also pointed to what he described as a $4.3 million increase in county information technology spending following the first attack, questioning whether those additional taxpayer-funded resources had produced meaningful improvements in cybersecurity protections.

"Residents deserve to know what that did, and why this happened again. Because this is a pattern, and it has to change," he said.

Among the questions Mr. Volke wants answered are what information was taken, whose personal information may have been compromised, why the administration waited seven weeks to disclose the August incident, why the County Council was not notified and how the additional IT funding was spent.

He called for prompt notification of affected residents, immediate communication with the County Council following cybersecurity incidents and greater accountability from County Executive Steuart Pittman's administration.

"Being transparent about a breach doesn't mean helping criminals. It means respecting the people whose data is at risk and who are paying the bill," Mr. Volke said.

He concluded his statement by calling for greater transparency and responsibility in county government.

"Anne Arundel County deserves a government that tells you the truth when something goes wrong and takes responsibility for fixing it."

The county's October 15 announcement did not specifically address the County Council's notification, the additional IT spending identified by Mr. Volke or the reason for the seven-week interval between discovery of the August incident and its public disclosure.

County Encourages Individuals to Monitor Personal Information

As officials continue addressing both incidents, the county is encouraging potentially affected individuals to take precautions against identity theft and other forms of financial or personal information misuse.

Those precautions include regularly reviewing bank and financial account statements, examining credit reports and checking health insurance explanations of benefits for unfamiliar transactions, discrepancies or suspicious activity.

Individuals who discover irregularities are encouraged to contact their financial institutions, insurance companies or health care providers, as appropriate.

The county acknowledged that cybercrimes targeting state and local governments have become an increasing concern nationwide.

Officials said additional information regarding the August 2026 incident will be released as significant findings become available.

The announcement did not establish when the investigation into the August incident would be completed or when notification letters related to that incident might be issued.