The Maryland Department of Transportation Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The Maryland Department of Transportation has been listed by the rhysida ransomware group, according to a report dated September 24, 2025. Public detail remains limited: the number of people affected is unknown, and the only description of exposed material is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group rather than an independently confirmed disclosure.

For an agency that oversees roads, transit, and related public services across Maryland, any unauthorized access to internal systems raises practical questions about operational continuity and the sensitivity of the records it holds. What is known so far is confined to the group’s claim and the reported fact of file exfiltration; further verification has not been made public.

Breaking down the breach

On September 24, 2025, the Maryland Department of Transportation appeared on a listing associated with the rhysida ransomware group. The available summary states only that internal files were exfiltrated during a ransomware attack. No public information has been released about the precise date of intrusion, the initial access method, the volume of data taken, or whether systems were encrypted in addition to the claimed theft. The number of individuals whose information may be involved is listed as unknown. Because these core details remain undisclosed, the scale and technical path of the incident cannot be described beyond the group’s claim and the reported fact of internal-file exfiltration.

The group behind it: rhysida

Rhysida is a ransomware operation that has been publicly documented since 2023. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a leak site on which it posts victim names and, in some cases, sample files. It has previously claimed attacks against organizations in government, education, healthcare, and other sectors. In this instance, the Maryland Department of Transportation’s appearance on the listing is presented by rhysida as a claim of successful compromise and data theft; independent confirmation of the full scope has not been provided in the available facts. No specific ransom demand, deadline, or sample files tied to this victim are detailed in the public report.

Maryland Department of Transportation and its sector

The Maryland Department of Transportation is a state government agency responsible for planning, building, operating, and maintaining transportation infrastructure and services across Maryland. Its portfolio typically includes highways, bridges, public transit systems, motor-vehicle administration functions, and related administrative and safety programs. Agencies of this type routinely hold employee records, contractor information, operational plans, vehicle and licensing data, and internal correspondence. A ransomware incident affecting such an organization is consequential because transportation systems are critical infrastructure; disruption can affect daily travel, emergency response coordination, and public trust in the security of government-held information. The precise systems involved in this case remain undisclosed.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, categories of personal data, or specific record sets has been released. Organizations in the transportation sector commonly maintain personnel files, financial and procurement documents, project plans, and records related to licensing or vehicle registration. Whether any of those categories were among the files claimed by rhysida is unconfirmed. Because the exact contents are not disclosed, it is not possible to state with certainty what personal or operational information, if any, left the agency’s control.

The real-world impact

For individuals whose data may have been among the internal files, potential risks include identity theft, phishing attempts that reference genuine personal details, or unauthorized use of contact or employment information. The actual exposure level cannot be quantified while the number of people affected and the precise data types remain unknown. For the Maryland Department of Transportation itself, the incident raises the possibility of temporary operational disruption, costs associated with investigation and recovery, and the need to notify affected parties if personal information is later confirmed to have been involved. Public confidence in the security of state transportation systems can also be affected, even when the full technical picture is still incomplete. No confirmed reports of secondary misuse tied specifically to this listing have been included in the available facts.

Were you affected?

If you are a current or former employee, contractor, or individual who has interacted with the Maryland Department of Transportation, consider the following practical steps while waiting for any official notification:

• Monitor financial accounts and credit reports for unexpected activity.
• Treat unsolicited emails or calls that reference transportation or state services with caution and verify them through official channels.
• Enable multi-factor authentication on important personal accounts where available.
• Retain any official communications from the agency about the incident for your records.

Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official updates from the Maryland Department of Transportation, if issued, remain the authoritative source for confirmation of individual impact.

AICompiled with AI assistance from public sources and published under our editorial standards.