ANNAPOLIS, Md — Anne Arundel County is grappling with its second cyberattack in a span of 18 months, and the county council was not informed of the recent incident until a full seven weeks had passed.
The county is currently looking into a cybersecurity breach that occurred in August, marking the second such event it has encountered, the first being in February 2025.
Councilman Nathan Volke expressed concern upon learning about the breach through news reports rather than from county officials, stating that such significant incidents should warrant immediate notification to the council.
“I found out through a newspaper article that we had been attacked. There was a reported breach, and information was allegedly compromised by an external organization that infiltrated our systems. I received more details through the press release than from our internal county communications,” Volke noted.
He articulated that the lack of timely notification is a serious issue. “Discovering this seven weeks later raises a red flag. It’s a significant problem,” he remarked.
Volke further questioned when the county’s top officials became aware of the breach, underscoring the importance of communication between branches of government. “When did the county executive first learn about it? What about the CAO and other senior officials? The county council is an equal branch of government,” he added.
In the wake of the February cyber incident, the county had allocated resources towards enhancing the security of its cyber networks. Volke commented that those enhancements proved beneficial during the most recent attack.
“I believe some of the investments we made following the last attack have certainly contributed to our ability to detect what was happening and to identify the most urgent issues that required addressing,” Volke explained.
Looking ahead, Volke emphasized the need for stronger protections regarding both cybersecurity and communication protocols. He proposed new legislation aimed at implementing formal notification requirements for cyber incidents.
“I want to explore legislation that mandates the executive branch to inform the legislative branch within a specific timeframe whenever a cyberattack or breach occurs because this is essential and needs to be codified,” Volke said.
Fortunately, the August incident did not disrupt any operations within the county, and officials are confident that essential services will remain unaffected.
Volke remarked that the council will persist in identifying methods to bolster cybersecurity defenses to prevent future attacks of this nature.
This story was initially reported by a journalist and has been converted to this platform with the assistance of AI. Our editorial team verifies all reporting on all platforms for fairness and accuracy.
