Health data potentially compromised after ransomware attack in Anne Arundel County
Patients who received treatments or services from the Anne Arundel County Department of Health may have had their data compromised during a cyber incident that impacted the county.
The cyber incident occurred between Jan. 28 and Feb. 22.
On February 22, the county was made aware of suspicious activity on certain computer systems.
"The ongoing investigation subsequently determined that there was unauthorized access to a limited subset of the county's network between January 28, 2025, and February 22, 2025, and that certain files within the network were accessed or downloaded without authorization during that time," the county said.
What information was affected?
Personal information that could have been impacted in the breach includes names, addresses and medical conditions, according to the county.
Officials do not believe financial information was compromised.
The county has not yet confirmed how many people were impacted by the data breach.
"The county is working with technical consultants to figure out what information was in the affected files and who it belongs to," officials said Thursday.
County officials said they will contact impacted individuals once they have been identified. The county is also sharing updates on its .
Investigation into Anne Arundel County cyber incident
The data breach is related to a cyber incident that impacted public service and government buildings in Anne Arundel County in late February.
Initially, county officials shared limited information, saying they did not want to tip off "potential threat actors."
By March, officials said they had made progress in securing the impacted systems, and most services were back online.
On Thursday, officials said the incident was a ransomware attack that originated from an outside threat actor. Their ongoing investigation determined that files within their network had been accessed and downloaded during the attack.
The county is continuing to work with technical consultants to find out what specific information may have been impacted.
Maryland agencies face similar incidents
Baltimore City Public Schools experienced a cyberattack in mid-February that exposed personal information of employees, volunteers, contractors, and some students.
That breach potentially revealed social security numbers, driver's license numbers, and passport information.
Baltimore schools notified affected people by mail on April 22 and offered free credit monitoring for two years.
The Baltimore City State's Attorney's Office was also impacted by that cyberattack.
After the Anne Arundel County ransomware attack, Executive Director Markus Rauschecker of the University of Maryland Center for Health and Homeland Security told WJZ there has been an uptick in cyber incidents targeting municipalities and healthcare systems.
