Systems Remain Down More Than a Week After Initial Disruption
Luminis Health, the nonprofit system operating Anne Arundel Medical Center in Annapolis and Doctors Community Medical Center in Lanham, confirmed on September 4, 2026, that it "was victim to a cyber incident by an unauthorized criminal actor" [1]. As of that update, the organization's phone system and MyChart patient portal remained offline [1]. The virtual urgent care platform CareConnectNow was also unavailable. Luminis Health has not published a restoration timeline [1], and no ransomware or data extortion group has publicly claimed responsibility for the attack [6].
The health system serves a large population across two Maryland counties through its hospitals and more than 100 care locations. Both affected hospitals remain open and treating patients [1][3], but certain appointments have been rescheduled [6], and ambulances carrying noncritical patients have been rerouted away from the emergency departments at both facilities according to a statewide monitoring system [3].
Timeline: Disruption Preceded Public Disclosure by at Least One Day
Luminis Health posted its first public acknowledgment on Facebook on the evening of Tuesday, September 1, 2026 [7]. The online patient portal was confirmed down as of 7:30 p.m. that evening [7].
Reporting from Hoodline, citing Eye On Annapolis, indicates that widespread outages had already begun the previous day, Monday, August 31, with staff reportedly sent home and networks going dark [4]. If accurate, this timeline suggests at least a one-day gap between internal disruption and public disclosure [4]. Luminis Health has not stated when the underlying unauthorized activity began or when it was first detected internally [8].
The more detailed incident update, posted to the Luminis Health website, carries a timestamp of September 4, 2026, at 5:30 p.m. [1]. That update introduced a dedicated patient helpline (443-222-0193) with extended hours through the Labor Day holiday weekend: Saturday, September 5 from 8 a.m. to 5 p.m., Sunday, September 6 from 8 a.m. to 5 p.m., and Monday, September 7 from 8 a.m. to 1 p.m. [1]. Regular helpline hours are Monday through Friday, 8 a.m. to 5 p.m. [1].
Systems Confirmed Unavailable
Based on statements from Luminis Health and reporting from multiple outlets, the following systems have been confirmed offline:
- Phone system (organization-wide) [1]
- MyChart (patient-facing portal for records, messaging, appointments, prescription refills, and video visits) [1]
- CareConnectNow (virtual urgent care platform serving patients across Maryland)
- Electronic patient records (staff at Anne Arundel Medical Center reverted to paper charts) [2]
A patient at Anne Arundel Medical Center described the environment as "a little bit chaotic," noting that "they were using paper charts for everything, but I didn't feel like it affected my patient care by any means" [2].
Attribution and Data Exposure Status
No group has claimed responsibility [6]. Luminis Health describes the actor only as "an unauthorized criminal actor" [1]. The organization has not identified the incident as ransomware. It has not disclosed the method of access or the scope of compromised systems beyond confirming patient-facing platforms are down.
Luminis Health has stated that its investigation into whether patient information was accessed or affected is ongoing [6]. The organization said it would notify individuals "in accordance with applicable legal requirements" if the investigation determines that notification is warranted [6]. As of available reporting, Luminis Health has not confirmed whether patient data was accessed, what categories of information may have been involved, or how many individuals might be affected.
Third-party cybersecurity experts and legal counsel have been engaged to support the investigation and restoration effort [1][3].
Separate Bomb Threat Incident Is Unrelated
Approximately two to three weeks before the cyberattack, both Luminis hospitals were placed on Code Black and lockdown after receiving an unverified phone threat [5]. During that earlier incident, EMS could not transport patients to Anne Arundel Medical Center while the Code Black was in effect, and Doctors Community Medical Center's emergency department remained in lockdown with an increased police presence [5]. Luminis Health confirmed at the time that the threat was unverified and that "contrary to many rumors floating around on social media, there was no gunman on the Annapolis campus" [5].
Some reporting has conflated these two events. No confirmed link exists between the phone threat and the subsequent cyberattack based on available public information.
Maryland Healthcare Sector: Recurring Target
This is not the first time a Maryland health system has experienced significant cyber disruption. Saint Agnes Hospital in Baltimore, part of the Ascension health system, was struck by an attack in May 2024. Nurses reported losing access to electronic patient records and reverting to fax machines and paper spreadsheets [3]. A separate ransomware attack hit Frederick Health in January 2025, resulting in ambulance diversions and emergency-admission restrictions. Luminis Health has not reported restrictions at that scale, but the ambulance rerouting of noncritical patients and the loss of electronic records follow a similar operational pattern [3].
A class action investigation has been initiated related to the Luminis breach, focused on whether the health system's disclosures and data protection practices met legal requirements [8].
Implications for Similarly Sized Health Systems
Luminis Health's footprint, serving patients across multiple counties through its hospitals and more than 100 care locations, is representative of mid-size nonprofit health systems throughout the United States. Several operational characteristics of this incident are instructive for comparable organizations.
First, the loss of the phone system alongside electronic health records and patient portals created a compounding effect. Patients could not call to confirm appointments, could not check MyChart, and could not access virtual urgent care through CareConnectNow [1]. The single dedicated helpline became the sole point of contact for the system's patient population [1][3].
Second, the disclosure gap between the reported August 31 operational disruption and the September 1 public statement [4][7] is a common pattern in healthcare cyber incidents but carries real consequences. Patients arriving at facilities during that window may not have known about system limitations. Health systems that lack pre-established communication playbooks for cyber incidents will likely face the same delay.
Third, the absence of a restoration timeline more than a week after the initial disruption is consistent with incidents that require full forensic imaging of affected systems before recovery can begin. MyChart is a product of Epic Systems; its presence at Luminis Health indicates Epic is the underlying EHR platform. Organizations relying on a single electronic health record platform face total portal loss during such events.
Red Sheep Assessment
Confidence: Moderate
The absence of a public ransomware claim more than a week after the initial disruption is notable but not conclusive. Several possibilities exist. The responsible actor may be conducting private extortion negotiations, a tactic that has become more common as groups attempt to avoid law enforcement attention drawn by public leak sites. Alternatively, the incident may involve a different class of intrusion, such as credential-based access leading to data theft without encryption, which would explain the system takedowns (likely initiated by Luminis Health's own containment actions) without a corresponding ransomware payload.
The fact that Luminis Health has not characterized the incident as ransomware, combined with the early decision to take systems offline and reportedly send staff home [4], is consistent with a containment-driven shutdown rather than an encryption event that forced systems down. This distinction matters because containment shutdowns can sometimes allow faster recovery of unaffected segments, but they also indicate that the organization's security team may have detected lateral movement or data staging that warranted broad network isolation.
The separate, unrelated bomb threat incident [5] occurring weeks before the cyberattack is likely coincidental. Defenders at peer institutions should track social engineering via phone threats as a potential reconnaissance or distraction method in coordinated attack campaigns. No evidence supports that interpretation here; it is mentioned strictly as a pattern to monitor.
Health systems of similar size should treat this incident as a planning reference. The operational impacts -- total portal loss, phone system failure, ambulance rerouting, and paper chart reversion -- represent a realistic worst-case scenario for any organization running centralized IT infrastructure without segmented failover for clinical communications.
Defender's Checklist
- ▢[ ] Verify that clinical communication systems (phone, portal, telehealth) are segmented from the primary EHR network so that a single compromise does not eliminate all patient contact channels simultaneously. Reference HHS 405(d) Health Industry Cybersecurity Practices (HICP), Technical Volume 1, Practice #3 (Asset Management) and Practice #4 (Network Management) for healthcare-specific network segmentation guidance.
- ▢[ ] Confirm that your organization has a pre-drafted public communication template for cyber incidents, with a target disclosure window of under 24 hours from operational impact, to reduce the gap between internal disruption and patient notification. Test this template against your state's breach notification statute timelines.
- ▢[ ] Test paper-based clinical workflow procedures at least annually, referencing Joint Commission Emergency Management (EM) standards, specifically EM.02.02.03 (procedures for managing utilities failures) and EM.02.02.09 (procedures for clinical activities during emergencies). Luminis staff reverted to paper charts [2]; organizations that have not drilled this process will face longer stabilization periods.
- ▢[ ] Review ambulance diversion protocols with your regional EMS coordination authority (in Maryland, MIEMSS) to ensure automatic rerouting triggers are documented and tested before an incident occurs [3].
- ▢[ ] Assess whether your MyChart or equivalent patient portal deployment includes an independent status page or alternate notification mechanism (e.g., SMS blast capability via a separate communications provider such as Everbridge or Twilio, hosted on infrastructure independent of the primary network) that remains functional during a primary system outage. Pre-load patient contact lists into the alternate notification system on a scheduled export basis.
References
[1] https://www.luminishealth.org/en/cybersecurity-incident-update?language_content_entity=en
[2] https://www.capitalgazette.com/2026/09/03/cybersecurity-incident-luminis-health-electronic-records/
[3] https://www.thebanner.com/community/public-health/luminis-cybersecurity-event-5D66ANTI7JH6PMTYACJ4VKKKIQ/
[4] https://hoodline.com/2026/09/luminis-health-hospitals-hit-by-cyberattack-portals-down-days-after-bomb-threat/
[5] https://www.eyeonannapolis.net/2026/08/unverified-threat-prompts-lockdown-at-luminis-health-hospitals/
[6] https://www.hipaajournal.com/luminis-health-jeffrey-reuben-well-child-horizon-eye-care-data-breaches/
[7] https://foxbaltimore.com/news/local/luminis-health-facilities-cyberattack
[8] https://www.classaction.org/data-breach-lawsuits/luminis-health-september-2026