Anne Arundel County faces second cyberattack in 18 months as council learns of breach weeks later

ANNAPOLIS, Md — Anne Arundel County is facing its second cyberattack within 18 months, and the county council wasn't made aware of the recent attack until seven weeks later.

The county is investigating a cybersecurity incident that happened in August. The attack is the second cyberattack the county has faced recently, with the first happening in February 2025.

For Councilman Nathan Volke, learning the details of the attack from the media was alarming because the council should have been advised about it by officials in county government.

"I then learned when I read in the newspaper, we've been attacked. Here's what happened there had been a breach. There was information that was being claimed to have been held by this other organization that got into our system so I got more information from the news press release that I got from internal county channels," Volke said.

Volke said the delay in notification is a significant concern. "We're learning about it seven weeks later that's a problem," Volke said.

He questioned when top county officials first became aware of the breach, emphasizing that the council is an equal branch of government.

"When did the county executive know? When did the CAO know? When did these other high ranking official officials in government because the county Council are an equal branch of government?" Volke said.

After the February attack, the county had invested in additional protection for its cyber networks. Volke said those investments made a difference during the latest incident.

"I think some of the investments that we made after the last attack have certainly helped with this attack in terms of discovering what was going on and being able to figure out how certain things happen and what was needing to be addressed most immediately," Volke said.

Now, Volke said there should be more safeguards around both cybersecurity and communication, and he wants to pursue legislation to formalize notification requirements.

"Then I want to be looking at legislation that will probably require the executive branch to notify the legislative branch with a certain period of time anytime there is a cyber attack or cyber breach because we have that and it needs to be in code," Volke said.

The August incident did not disrupt any county operations, and officials say they do not expect any impact on essential services.

Volke said the council will continue to look at ways it can strengthen the barriers around things like cybersecurity in hopes this type of attack doesn't happen again.

This story was initially reported by a journalist and has been converted to this platform with the assistance of AI. Our editorial team verifies all reporting on all platforms for fairness and accuracy.