Chesapeake Bay Maritime Museum Data Breach

**Chesapeake Bay Maritime Museum Reports Data Breach Affecting 5,181 Individuals** The Chesapeake Bay Maritime Museum (CBMM) disclosed a data breach in August 2024, notifying 5,181 individuals that their personal information—including names, Social Security numbers, and financial account details—was compromised. The ransomware group *Helldown* claimed responsibility for the attack, posting stolen documents such as invoices, contracts, and inspection reports as proof. CBMM has not confirmed the group’s involvement or whether a ransom was paid. According to the museum’s notice, unauthorized access occurred between August 8 and 9, 2024, with suspicious activity detected on August 9. The breach’s discovery and victim notification were delayed by over a year. As a remedial measure, CBMM is offering affected individuals 12 months of free credit monitoring through IDX. *Helldown*, a relatively new ransomware operation, employs double-extortion tactics—encrypting systems while exfiltrating data to demand payment for decryption and data deletion. Since its emergence in August 2024, the group has claimed 33 breaches, with six confirmed by researchers. Among its targets were Swiss engineering firm Schlatter Group (which reported 10 days of downtime) and Cincinnati Pain Physicians (which incurred six-figure losses). The incident reflects broader ransomware trends in the U.S., where 884 confirmed attacks were logged in 2024, followed by 543 in 2025. Recent breaches include attacks on healthcare providers, financial institutions, and small businesses, with groups like Medusa, Akira, and Play demanding ransoms ranging from tens to hundreds of thousands of dollars. Located in St. Michaels, Maryland, CBMM spans an 18-acre campus and attracts nearly 100,000 visitors annually. The breach underscores the persistent threat ransomware poses to organizations across sectors, disrupting operations and exposing sensitive data.