Luminis Health cyber incident disrupts patient systems

Analyst assessment

Luminis Health confirmed that certain systems were unavailable because of a cybersecurity incident. The health system said it took immediate steps after identifying the incident and began an investigation with legal counsel and outside cybersecurity specialists. Our reporting found that MyChart and CareConnectNow remained unavailable across the health system Sept. 2 and outpatient delays were possible as recovery continued.

The first observed disruption identified in public reporting occurred Aug. 31, when Eye On Annapolis described widespread system problems. Luminis Health’s first reviewed cyber-specific public disclosure was Sept. 1. The public record does not establish when the underlying intrusion began, the affected network segment or the malicious technique.

Operational significance

Luminis Health’s patient portal and virtual urgent care service were unavailable, preventing patients from using MyChart functions such as viewing records and results, messaging care teams, scheduling appointments, requesting prescription refills and joining video visits. CareConnectNow’s outage removed a virtual urgent care channel. The health system warned that patients could experience delays and asked people with questions about appointments or scheduled services to call a dedicated number during business hours.

Eye On Annapolis reported that employees were sent home and a hospital entered Code Black as the Aug. 31 system disruption continued. The publication said it was unclear whether those initial failures and the Code Black were connected to the cybersecurity incident disclosed the next day. Luminis Health later directly tied certain unavailable systems to the cyber incident, but it has not confirmed that every reported Aug. 31 operational effect had the same cause.

WBAL-TV reported that Anne Arundel Medical Center canceled treatments and rerouted patients to other hospitals. The Maryland Department of Health told the station that Luminis alerted the state Aug. 31 that technology problems had resulted in a reroute. A cancer patient told WBAL that a radiation treatment scheduled for Aug. 31 was postponed and had not been rescheduled when the station reported the disruption Sept. 3.

A Sept. 9 WBAL follow-up documented continuing patient-care effects. A patient with aggressive breast cancer said her second infusion in a time-sensitive six-month chemotherapy regimen was canceled because Luminis could not provide an alternate location. Another patient said she had waited 10 days for imaging results needed to determine whether further treatment was necessary. WBAL reported that some medical services had been rescheduled. Luminis said it was still determining which systems and how many patients were affected but did not confirm the individual cases or provide an affected-appointment count.

The health system said it continued providing care, and its hospitals remained open. The reviewed sources do not establish that inpatient care stopped or that the reported delays caused clinical harm.

Impacted locations

The incident affected shared services across Luminis Health rather than a single named facility. Annapolis and Lanham are recorded as impacted municipalities because the system’s three hospitals are located in those two communities: Luminis Health Anne Arundel Medical Center and J. Kent McNew Family Medical Center in Annapolis, and Luminis Health Doctors Community Medical Center in Lanham. Luminis Health also operates more than 100 practice locations across Maryland, but the reviewed sources do not establish an on-site operational effect in each municipality containing an ambulatory location.

Data impact

The Baltimore Banner reported that a patient filed a proposed federal class-action lawsuit Sept. 11 and two more patients joined Sept. 16. The complaint alleges that patient records were exposed in an unencrypted, internet-accessible environment. Those allegations are not an independent finding that data was accessed or stolen, and they do not establish an affected-person count.

Luminis previously said its patient-record storage system was unaffected. Its Oct. 8 FAQs say investigators are still determining whether information was affected and that required notices will follow any such finding. The earlier storage-system statement, retained under Previous FAQs, does not resolve possible exposure elsewhere. No affected-person count or data category has been disclosed.

Current status

Luminis Health reported Sept. 18 that telephone service had been restored across all locations and MyChart was available in read-only mode. WYPR reported Sept. 22 that other system issues continued. Its description of MyChart as entirely offline conflicted with Luminis’ dated read-only notice.

MyChart scheduling, refill requests and provider messaging returned Sept. 29. On Oct. 8, Luminis reported that its systems had been restored and its hospitals, practices and other care locations continued seeing patients. Teams were still entering and reconciling documentation from the downtime period; some patient notes, laboratory results and imaging results might not yet appear in MyChart. The health system also said payment plans had been paused during the outage and would resume without outage-related delinquency. These remaining documentation and billing tasks are distinct from continued system unavailability. The investigation remained open. Oct. 8 is the latest dated operational observation; no earlier system-restoration date was disclosed.

Confidence and uncertainty

Confidence is high that a cybersecurity incident caused material operational disruption because Luminis Health directly connected unavailable systems to the incident, the Maryland Department of Health confirmed that technology problems resulted in patient rerouting, and WBAL documented canceled or delayed cancer care and delayed imaging results through patient interviews. The total number of affected patients and services remains unknown, and Luminis did not confirm the individual cases. The health system said its patient-record storage system was unaffected, but the investigation had not reached a final conclusion about all possible data effects. Cyber involvement is confirmed; ransomware, extortion and actor attribution remain unresolved.

Searches for Luminis Health and luminishealth.org in public ransomware and extortion sources found no stable victim claim tied to this incident. That negative finding does not establish that no claim exists, but no extortion indicator is currently identified in the available evidence.

Analytic gaps

The public record does not identify when unauthorized activity began, how systems were accessed, which internal systems were affected beyond the named patient platforms, whether electronic health records remained available to clinicians, whether clinical devices were affected, whether patient information was accessed, the total number of delayed or rescheduled visits, whether delayed care caused clinical harm, remediation costs or the exact date each affected system returned.