Local
Anne Arundel councilman seeks breach-notification rules after August cyber incident
Anne Arundel County is investigating an August cyber incident, its second in 18 months; County Council members say they were not briefed until seven weeks later. Councilman Nathan Volke says he wants legislation requiring the executive branch to notify the council about future cyberattacks or breaches.
ANNE ARUNDEL COUNTY, Md. — County officials are investigating a cybersecurity incident from August, but members of the County Council say they did not learn about it until seven weeks later — a delay that one councilman says he wants addressed through legislation.
The incident is the county’s second cyberattack in about 18 months. The previous attack occurred in February 2025. County officials have said the August incident did not disrupt county operations and is not expected to affect essential services.
Councilman Nathan Volke said he learned of the breach through news coverage and received more information there than through internal county communications. He said the council should have been notified sooner and questioned when the county executive, the chief administrative officer and other senior officials became aware of the incident.
“Learning about it seven weeks later — that’s a problem,” Volke said.
Volke also said cybersecurity investments made after the February 2025 attack helped the county detect and assess the latest incident. He wants the council to consider measures to strengthen both network security and communication between the county’s executive and legislative branches.
He said he plans to pursue legislation that would set a required timeframe for the executive branch to notify the council when a cyberattack or breach occurs. The councilman said he wants that requirement written into county law.
The county is still investigating the August incident. Officials have not reported an interruption to services, and the available information does not specify what systems or data may have been affected.