Annapolis, MD (October 15, 2026) - On February 22, 2025, the county became aware of suspicious activity affecting certain systems within the county computer network. The county immediately launched an investigation to determine the full nature and scope of the activity with the assistance of industry-leading cybersecurity specialists, law enforcement partners, and relevant state agencies. Our investigation subsequently determined there was unauthorized access to a limited subset of our network between January 28, 2025, and February 22, 2025, and that certain files within the network were accessed or downloaded without authorization during that time.
A preliminary public notice was issued on May 15, 2025, via local media outlets and on the county website to alert potentially affected individuals. The county undertook a comprehensive third-party review of the impacted files to determine what information was contained therein, and to whom the information related to notify potentially affected individuals. That review was recently completed, and direct notification letters to individuals will be distributed beginning the week of October 19, 2026.
The categories of information that may be involved varies by individual. As a precautionary measure, individuals are encouraged to remain vigilant against incidents of identity theft by reviewing account statements, credit reports, and explanations of benefits for unusual activity and to detect errors. Any suspicious activity should be promptly reported to the appropriate health care providers, insurance company, or financial institution. Additional information can be found online under Steps You Can Take to Help Protect Personal Information.
In a separate incident, on August 28, 2026, the county detected irregular activity on a limited subset of systems within the county computer network. Immediate action was taken to secure the network and determine the potential scope and source of this activity. This activity did not interfere with the county’s operations and there is no anticipated impact to any essential services moving forward.
Third-party cybersecurity specialists were engaged to conduct a comprehensive digital forensics investigation of the county’s network. Through the course of the county’s response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems.
Recent reports indicate that there has been a surge in these kinds of calculated cybercrimes specifically targeting state and local governments.
Presently, there is no indication the files have been used to commit any type of consumer fraud or identity theft or that this event was related to any previous cyber event. The county and its response team are undertaking a review of the files involved to determine their contents, whether the files relate to individuals, and the information associated with those individuals. Based on this review, the county will notify any affected individuals in compliance with applicable law.
As part of its investigation, the county notified governmental partners, including federal law enforcement, and is coordinating its response efforts. The county will provide further updates as material information becomes available.