Luminis Health is the Annapolis, Maryland health system that runs Anne Arundel Medical Center and Doctors Community Medical Center. In early September 2026 it disclosed a cybersecurity incident that it later blamed on an "unauthorized criminal actor" (Becker's Hospital Review). The attack took the MyChart patient portal offline from September 1 until about September 29, and cut phone service until September 16. It also pushed clinicians at both hospitals onto paper charts. Luminis said on October 8 that all systems were restored, but its investigation is still open. No threat actor has been named, no ransomware group has claimed the attack, and the company has not confirmed that any patient data was taken. A proposed federal class action argues that patient data was exposed, so the question is already being fought in court. Luminis says it serves more than 1.8 million patients across Anne Arundel and Prince George's counties and the Eastern Shore (CBS Baltimore).
What Happened
On September 1, Luminis posted an alert on its website saying it was "responding to a cybersecurity incident affecting certain systems across our organization" (CBS Baltimore, Becker's). The Baltimore Banner gives a slightly different date and says Luminis first acknowledged the attack on September 2. The gap is most likely the difference between the website alert and a wider public statement. Either way, the incident started at the very beginning of September.
How the outage and recovery unfolded:
- Early September: The hospitals temporarily diverted noncritical emergency cases, according to the Banner. Becker's says some patients were sent to other facilities. Clinicians switched to paper records, and WBAL reported that patient care was delayed at AAMC by September 9.
- September 10: Luminis said MyChart and its phones were still down and gave no date for restoring them. It said the hospitals stayed open (Becker's).
- September 16: Phone service was restored at all locations (Becker's, CBS Baltimore). Luminis described "considerable progress in restoring affected systems."
- About September 29: MyChart came back. Shattered.io gives September 29 as the date. Becker's, citing Luminis, says only "late September."
- October 8: Luminis said all systems were restored. Staff were still entering documentation from the downtime, and some notes, lab results and imaging results may not yet appear in MyChart (Becker's, Luminis incident page).
How long the outage lasted depends on what you measure. MyChart was down for about four weeks. Full restoration took more than five weeks, which the Banner rounded to "six weeks after a cyberattack." Patient payment plans were paused during the outage. Luminis says they will be reset and will not go delinquent.
What Was Taken
Nothing is confirmed. Luminis says its forensic investigation is still trying to find out "what information, if any," was affected. It has promised to notify individuals "in accordance with applicable requirements" if notification turns out to be required (Luminis incident FAQ, Becker's). It has not committed to offering credit monitoring.
The accounts disagree on one point that matters:
- Luminis's position: "The recent cyber incident did not affect the system that stores/hosts our patient records" (statement to Fox Baltimore, also reported by the Banner).
- The plaintiffs' position: The complaint alleges that patient data was kept in an "unencrypted, Internet-accessible environment" and that patients now face a "certainly impending" risk of fraud and loss of health privacy (Fox Baltimore, CBS Baltimore, WBAL).
These claims do not necessarily cancel each other out. Saying the core EHR was untouched does not rule out data being taken from file shares, billing systems, backups or other places. Still, the lawsuit's claims are allegations and have not been tested. No public source documents exfiltration, a leak-site listing or a confirmed record count. The only scale figure available comes from the plaintiffs, who say "tens of thousands" of people could qualify for the class (CBS Baltimore, via the Banner). Readers should treat that as a litigation estimate, not a breach count.
Jokisha White filed the complaint in federal court on September 11. Anne Arundel County residents Rachel Rogers and Angela Ritchie joined it the following week and asked for class status. The plaintiffs want monetary damages and at least 10 years of credit monitoring (CBS Baltimore, WBAL, Fox Baltimore). Legal experts quoted by WBAL and Fox Baltimore said these cases are hard to win unless plaintiffs can show actual harm.
Why It Matters
Ransomware-style damage without a confirmed ransomware attack. Luminis has not used the word ransomware. But the pattern looks like one: a criminal actor, a system-wide outage, phones down, a return to paper, ER diversion and a staged recovery over several weeks. UMBC's Anupam Joshi told Fox Baltimore that the attacker could have been "exfiltrating data… shutting down systems… doing ransomware. We can speculate wildly." Defenders should plan for the operational impact whatever the attack turns out to be called.
The patient portal took longest to come back. Phones returned in about two weeks. MyChart took about four. Patient-facing systems connect directly to the EHR and to identity systems, so they need the most careful checking before they go back online. Luminis said it tested and validated each system as it returned. Organizations should expect that kind of gap and plan around it.
Litigation now comes before forensics. A class action was filed ten days after disclosure, before Luminis had confirmed any data exposure. Under HIPAA's breach rules, notification can come up to 60 days after discovery, as Joshi noted. So health systems now have to manage legal risk while the facts are still unknown, and every public statement becomes evidence.
Recovery leaves a documentation backlog. Reconciling records from weeks of paper charting was still going on after October 8. Gaps in charts, delayed results and paused billing all carry clinical and financial risk after the systems are technically back.
The Attack Technique
Nothing about the intrusion has been disclosed. Luminis has not described the initial access vector, how the attacker moved through the network, what tooling was used, or whether systems were encrypted. It has said only that forensic specialists are still working to determine "the full nature and scope of the incident" and that it wants any information it shares "to be based on confirmed findings" (Becker's).
The only technical claim in the public record is the lawsuit's allegation about unencrypted, internet-accessible data storage, and it has not been proven. No ransomware group or other actor has been publicly linked to the attack in the available reporting. This brief makes no attribution.
What Organizations Should Do
- Build and rehearse multi-week downtime procedures. Paper charting, manual lab and imaging workflows, and ER diversion criteria should be tested for outages lasting weeks, not days. Include a plan for entering the paper backlog into the EHR once systems return.
- Separate patient-facing and communications systems from clinical cores. Two weeks without phones made the outage much worse. Keep out-of-band voice and paging, and segment portals like MyChart so that rebuilding one system does not force another offline.
- Find and encrypt sensitive data outside the EHR. The lawsuit's central allegation concerns data in an unencrypted, internet-facing environment. Inventory exports, file shares, reporting databases and backups holding PHI, and encrypt them at rest and remove public exposure.
- Pre-stage forensic and legal support and agree on what you will say. Have IR retainers and outside counsel in place before an incident. Agree in advance on what can be said publicly before forensics is finished, because statements like "patient records were not affected" will be tested in litigation.
- Plan for the financial side of an outage. Luminis paused patient payment plans and reset them so they would not go delinquent. Decide ahead of time how billing, collections and patient financial accounts will be handled during an outage.
- Watch for follow-on phishing. Luminis has warned patients about suspicious calls, emails and texts. Attackers often exploit outages by impersonating the affected provider, so warn patients and staff early and set up a verified channel for official updates.
Sources: Luminis Health MyChart Restored After Cyberattack 2026 | Luminis Health restores systems following cybersecurity incident | Luminis Health MyChart, phones remain offline amid cyberattack | Luminis Health Cybersecurity Incident Update | Luminis Health cyberattack: Company says systems are back online -... | Luminis Health faces class-action lawsuit as cyberattack exposes pa... | Luminis Health sued over alleged failure to protect patient data af... | Patients file lawsuit over Luminis Health cyberattack